How is a Nodejs application distributed to customers?

Question

I’m taking a look at Nodejs and a question has arisen about its distribution.

Assuming I have a company, and I use Express/Nodejs to create a simple REST service for my main application. To install this server on a client, would I need to install Nodejs on that server? Isn’t there a... main server (thing like Wildfly, Apache, Xamp, etc...) to support a Nodejs server? And the client, could simply edit the . js files from Node?

Answer 1

With Node.js (which allows you to create applications for server-side) and assuming you have control over the following aspects of your server:

• Entry and exit doors
• SSH (or can directly install anything on your server)

You could simply release the ports to create a server for your API, or you could use something like:

• https://www.npmjs.com/package/node-fastcgi

Thereby I believe that you could communicate with Apache or Ngnix, then create a Virtualhost in Apache or a host in Nginx.conf to port to the Fastcgi port that is running your application written for Node.js

Or if you are using Express (which is much more likely), you could simply use the ProxyPass (https://httpd.apache.org/docs/2.4/mod/mod_proxy.html) with VirtualHost in the Apache, so:

<VirtualHost api.site.com:80>   
     ServerName api.site.com 
     ProxyPass "/" "http://localhost:5000/"
</VirtualHost>

This way I think it is much easier to use any module for Node.js, because it would be enough to use what you already have, of course in this case also depends on you have control over the server.

PS: http://localhost:5000/ would be the local host and port for the Express application

---

And the client, could simply edit the . js files from Node?

The customer could only edit his .js or .php if he has access to the server, if he has it he can "screw it up," or modify it, or ask whoever it is to modify it, but if his intention is to protect the codes, then encryption could be a possible attempt, however not even encrypted or compiled codes are "saved", there is reverse engineering, there is still the possibility if the client bought from you the code is his and if he requires you will have to provide, I will not go into this matter, because it goes to the legal side, of which I have no knowledge to speak.

Back to what matters, as I said, nothing is really free, reverse engineering is complicated but not impossible, so if your goal is to prevent you from breaking the application the solution I propose to you is simply to be the one who controls the server, with ProxyPass for example you can hire a hosting party and your client’s server point to the address of this other server.

<VirtualHost api.sitedocliente.com:80>   
     ServerName api.sitedocliente.com 
     ProxyPass "/" "http://hospedagemapartequecontratei.com/"
</VirtualHost>

Of course this goes to the side of "security", if the goal is that the customer only access via api.sitedocliente.com and wishes to prevent access to hospedagemapartequecontratei.com then a simple and minimal solution would be to check the IP of the server that requested the other, would be like this:

• On your server with Node.js you should check the value of request.connection.remoteAddress, assuming that your client has a fixed IP on the server, this way could limit access only to this IP.

• If you do not have a fixed IP, or this is impracticable you can then try to limit access with x-headers, which are automatically configured by Proxypass, so would check if X-Forwarded-Host contains the name api.sitedocliente.com (this is an example), but note that this can be easily circumvented.

I didn’t test the ProxyPass under these conditions (both local and on different servers), if something fails let me know that I will edit the answer.