hapijs / hapijs/hapi

Ability to add custom "tap" into the request stream

Open
#4,185 0 comments 0 reactions 1 assignee Claimed by @geek View on GitHub
feature
Dominant language
JavaScript
Stars
14.8k
Forks
1.4k
Avg merge
22d 3h
Merged PRs (30d)
1

Description

#### Support plan

* *is this issue currently blocking your project?* (yes/no): no
* *is this issue affecting a production system?* (yes/no): no

#### Context

* *node version*: 12+
* *module version*: 20+
* *environment* (e.g. node, browser, native): node
* *used with* (e.g. hapi application, another framework, standalone, ...): hapi application
* *any other relevant information*:

#### What problem are you trying to solve?

Ability to perform an integrity check (and prevent any processing of corrupted data) of a request stream

I am currently performing request integrity check but this requires to do the following:
```js
if (request.payload !== undefined) {
throw badImplementation('Integrity check requires that the payload was not already processed')
}

const hash = createHash(algorithm)

request.events.on('peek', (chunk, encoding) => {
hash.update(chunk, encoding)
})

request.events.on('finish', () => {
const payloadDigest = hash.digest('base64')
if (payloadDigest !== expectedDigest) {
request.raw.req.destroy(Boom.badData('Corrupted payload'))
}
})
```
There are several issues with that implementation:
1) It relies on the fact that the finish handler is triggered synchronously (otherwise the destruction of the raw req would occur too late)
2) It requires that the payload was not previously processed (e.g. by the `auth.payload`)
3) We can't prevent the payload to be processed by other listeners

It would be nice to have the ability to manually `tap` into the request:
- From the `onRequest` ext
- From an authentication scheme

#### Do you have a new or modified API suggestion to solve the problem?

```js

const [algo, hash] = getDigestData(request)
request.tap(new DigestCheck(algo, hash)) // throws if `request.payload` is already set

```

I would be open to create a PR for this but I would like to make sure that:
1) You would be open to add this
2) What kind of API you would see for this

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.