default env to production
- Dominant language
- JavaScript
- Stars
- 69.5k
- Forks
- 25k
- Avg merge
- 4d 20h
- Merged PRs (30d)
- 9
Description
I just want to query the defaulting of env to 'development' in `app.defaultConfiguration`.
In a situation where verbose error messaging may expose sensitive information, there is a risk on information leakage from someone failing to explicitly set `NODE_ENV=production`.
I'm keen to see the arguments for it being 'development', my feeling is that it should be defaulted to 'production' and then if for some reason it hasn't been explicitly set so, the risk of information leakage is mitigated. Though its entirely likely I'm just being stupid.
EDIT:
Because it felt like a bit of bad manners to raise an issue without raising a PR to fix it see here: https://github.com/expressjs/express/pull/3347
EDIT: On **_'view cache'_** and more
Having read through:
- https://expressjs.com/en/advanced/best-practice-performance.html#set-nodeenv-to-production
- https://github.com/expressjs/express/blob/master/lib/application.js
The key performance benefit of setting `NODE_ENV=production` is that views are cached when using `app.render`. With the first link above stating an app performance boost of up to 'a factor of 3'.
Again I think there is benefit to defaulting to 'production' in this case, as by default we should want 'express' to be the most performant it can be, giving users the best possible experience straight out of the box.
Contributor guide
Assessment
This issue has not been assessed yet.