expressjs / expressjs/express

default env to production

Open
#3,346 11 comments 6 reactions 0 assignees View on GitHub
6.x discuss
Dominant language
JavaScript
Stars
69.5k
Forks
25k
Avg merge
4d 20h
Merged PRs (30d)
9

Description

I just want to query the defaulting of env to 'development' in `app.defaultConfiguration`.

In a situation where verbose error messaging may expose sensitive information, there is a risk on information leakage from someone failing to explicitly set `NODE_ENV=production`.

I'm keen to see the arguments for it being 'development', my feeling is that it should be defaulted to 'production' and then if for some reason it hasn't been explicitly set so, the risk of information leakage is mitigated. Though its entirely likely I'm just being stupid.

EDIT:
Because it felt like a bit of bad manners to raise an issue without raising a PR to fix it see here: https://github.com/expressjs/express/pull/3347

EDIT: On **_'view cache'_** and more
Having read through:
- https://expressjs.com/en/advanced/best-practice-performance.html#set-nodeenv-to-production
- https://github.com/expressjs/express/blob/master/lib/application.js

The key performance benefit of setting `NODE_ENV=production` is that views are cached when using `app.render`. With the first link above stating an app performance boost of up to 'a factor of 3'.

Again I think there is benefit to defaulting to 'production' in this case, as by default we should want 'express' to be the most performant it can be, giving users the best possible experience straight out of the box.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.