Merge pull request #7 from sharetribe/server-security-setup

Server security setup

README.md

@@ -19,20 +19,20 @@ Install required tools:
 
 Clone this repository and install dependencies:
 
-    yarn
+    yarn install
 
 ## Development
 
 To develop the application and to see changes live, start the frontend
 development server:
 
-    npm run dev
+    yarn run dev
 
 ## Development Server
 
 To develop the server setup, run:
 
-    npm run dev-server
+    yarn run dev-server
 
 This runs the frontend production build and starts the Express.js
 server in `server/index.js` that renders the application routes in the
@@ -52,5 +52,9 @@ See more in the [testing documentation](docs/testing.md).
 
 ## Production Server
 
-    npm run build
-    npm start
+Ensure that the `NODE_ENV` environment variable is set to `production`
+and run:
+
+    yarn install
+    yarn run build
+    yarn start

package.json

@@ -7,6 +7,7 @@
   },
   "dependencies": {
     "express": "^4.14.0",
+    "helmet": "^3.3.0",
     "lodash": "^4.17.4",
     "nodemon": "^1.11.0",
     "react": "^15.4.2",
@@ -23,6 +24,6 @@
     "test-ci": "sharetribe-scripts test --env=jsdom --runInBand",
     "eject": "sharetribe-scripts eject",
     "start": "node server/index.js",
-    "dev-server": "npm run build&&nodemon --watch server server/index.js"
+    "dev-server": "yarn run build&&nodemon --watch server server/index.js"
   }
 }

server/index.js

@@ -17,6 +17,7 @@
 require('source-map-support').install();
 
 const express = require('express');
+const helmet = require('helmet');
 const path = require('path');
 const fs = require('fs');
 const _ = require('lodash');
@@ -65,16 +66,22 @@ const template = _.template(indexHtml, {
 });
 
 function render(url, context) {
-  const { head, body } = renderApp(url, context)
+  const { head, body } = renderApp(url, context);
   return template({
     title: head.title.toString(),
     body
   });
 }
 
+const env = process.env.NODE_ENV;
+const dev = env !== 'production';
 const PORT = process.env.port || 4000;
 const app = express();
 
+// The helmet middleware sets various HTTP headers to improve security.
+// See: https://www.npmjs.com/package/helmet
+app.use(helmet());
+
 app.use('/static', express.static(path.join(buildPath, 'static')));
 
 app.get('*', (req, res) => {
@@ -95,5 +102,8 @@ app.get('*', (req, res) => {
 });
 
 app.listen(PORT, () => {
-  console.log(`Listening on port ${PORT}`);
+  console.log(`Listening to port ${PORT} in ${env} mode`);
+  if (dev) {
+    console.log(`Open http://localhost:${PORT}/ and start hacking!`);
+  }
 });