Khon tkt028

Let's have some command-line fun with curl, [jq][1], and the [new GitHub Search API][2].

Today we're looking for:

tl;dr

Don't run as root.
For sessions, set httpOnly (and secure to true if running over SSL) when setting cookies.
Use the Helmet for secure headers: https://github.com/evilpacket/helmet
Enable csrf for preventing Cross-Site Request Forgery: http://expressjs.com/api.html#csrf
Don't use the deprecated bodyParser() and only use multipart explicitly. To avoid multiparts vulnerability to 'temp file' bloat, use the defer property and pipe() the multipart upload stream to the intended destination.

This gist is part of a blog post. Check it out at:

	Secure sessions are easy, but it's not very well documented, so I'm changing that.
	Here's a recipe for secure sessions in Node.js when NginX is used as an SSL proxy:

	The desired configuration for using NginX as an SSL proxy is to offload SSL processing
	and to put a hardened web server in front of your Node.js application, like:

	[NODE.JS APP] <- HTTP -> [NginX] <- HTTPS -> [CLIENT]

	To do this, here's what you need to do:

	#
	# Working with branches
	#

	# Get the current branch name (not so useful in itself, but used in
	# other aliases)
	branch-name = "!git rev-parse --abbrev-ref HEAD"
	# Push the current branch to the remote "origin", and set it to track
	# the upstream branch
	publish = "!git push -u origin $(git branch-name)"

	Installing Arch:


	sudo vim /etc/pacman.conf
	Update packages list: sudo pacman -Syy
	run sudo pacman -Syu before installing any software (to update the repositories first)

	* Timing issue:
	- Change hardware clock to use UTC time:
	sudo timedatectl set-local-rtc 0