Tips

How to create static HTTP server in Node.JS?

How to create static HTTP server in Node.JS?

If you want to serve static files on your Node.JS web application, you can create a simple static HTTP server in Node.JS.
Node.JS is a event-driven server-side JavaScript runtime, that uses V8 JS engine (same as Chromium) and executes code outside a web browser.
In this article we will cover basics of implementation of HTTP server in Node.JS and build a simple static HTTP server.

Prerequisities

  • Node.JS installed on your development machine

Built-in HTTP module

Node.JS has built-in http module, which allows Node.JS to communicate over HyperText Transfer Protocol (HTTP).
To include that module, we use require() method:

var http = require("http");

“Hello, World” server

In this example, the server sends “Hello, World” response. This server is listening at port 8080:

server.js
1
2
3
4
5
6
7
8
9
10
11
12
13
//Hello World server
var http = require("http");
var port = 8080;
var server = http.createServer(function (req, res) {
  res.writeHead(200, "OK", {
    "Content-Type": "text/plain"
  });
  res.write("Hello, World!");
  res.end();
});
server.listen(port, function() {
  console.log("Started server at port " + port + ".");
});

For creating HTTP server object we use http.createServer() method. Server will then listen at port 8080. This server writes header indicating, that we’re sending plain text. Then it sends “Hello, World” message and ends the connection.
Save the code above in a file called server.js and start the server using node server.js.

If you visit localhost:8080 in your web browser, the result will look like this:
Hello World server

Serving files using Node.JS

For reading files, we’re using fs module and fs.readFile() method.
The code will look like this:

server.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
//Serving index...
var http = require("http");
var fs = require("fs");
var port = 8080;
var server = http.createServer(function (req, res) {
  fs.readFile("index.html", function(err, data) {
    if(err) {
      res.writeHead(500, "Internal Server Error", {
        "Content-Type": "text/plain"
      });
      res.end("500 Internal Server Error! Reason: " + err.message);
    } else {
      res.writeHead(200, "OK", {
        "Content-Type": "text/html"
      });
      res.end(data);
    }
  });
});
server.listen(port, function() {
  console.log("Started server at port " + port + ".");
});

This code will serve index.html file, and returns 500 error if there was a problem reading that file.
But what if that index file doesn’t exist? We will then need to serve 404 error page:

server.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
//Serving 404...
var http = require("http");
var fs = require("fs");
var port = 8080;
var server = http.createServer(function (req, res) {
  fs.readFile("index.html", function(err, data) {
    if(err) {
      if(err.code == "ENOENT") {
        //ENOENT means "File doesn't exist"
        res.writeHead(404, "Not Found", {
          "Content-Type": "text/plain"
        });
        res.end("404 Not Found");
      } else {
        res.writeHead(500, "Internal Server Error", {
          "Content-Type": "text/plain"
        });
        res.end("500 Internal Server Error! Reason: " + err.message);
      }
    } else {
      res.writeHead(200, "OK", {
        "Content-Type": "text/html"
      });
      res.end(data);
    }
  });
});
server.listen(port, function() {
  console.log("Started server at port " + port + ".");
});

Note, that in static HTTP servers, files are determined from resource URL.

server.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
//WARNING!!! PATH TRAVERSAL
var http = require("http");
var fs = require("fs");
var port = 8080;
var server = http.createServer(function (req, res) {
  var filename = "." + req.url;
  if(filename == "./") filename = "./index.html";
  fs.readFile(filename, function(err, data) {
    if(err) {
      if(err.code == "ENOENT") {
        //ENOENT means "File doesn't exist"
        res.writeHead(404, "Not Found", {
          "Content-Type": "text/plain"
        });
        res.end("404 Not Found");
      } else {
        res.writeHead(500, "Internal Server Error", {
          "Content-Type": "text/plain"
        });
        res.end("500 Internal Server Error! Reason: " + err.message);
      }
    } else {
      res.writeHead(200, "OK", {
        "Content-Type": "text/html"
      });
      res.end(data);
    }
  });
});
server.listen(port, function() {
  console.log("Started server at port " + port + ".");
});

But we have introduced path traversal vulnerability (being able to access file outside the web root)! To mitigate that, we’ll use a regular expression, that removes all dot-dot-slash sequences from file name:

server.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
//Path traversal mitigated
var http = require("http");
var fs = require("fs");
var port = 8080;
var server = http.createServer(function (req, res) {
  var filename = "." + req.url;
  filename = filename.replace(/\\/g,"/").replace(/\/\.\.?(?=\/|$)/g,"/").replace(/\/+/g,"/"); //Poor mans URL sanitizer
  if(filename == "./") filename = "./index.html";
  fs.readFile(filename, function(err, data) {
    if(err) {
      if(err.code == "ENOENT") {
        //ENOENT means "File doesn't exist"
        res.writeHead(404, "Not Found", {
          "Content-Type": "text/plain"
        });
        res.end("404 Not Found");
      } else {
        res.writeHead(500, "Internal Server Error", {
          "Content-Type": "text/plain"
        });
        res.end("500 Internal Server Error! Reason: " + err.message);
      }
    } else {
      res.writeHead(200, "OK", {
        "Content-Type": "text/html"
      });
      res.end(data);
    }
  });
});
server.listen(port, function() {
  console.log("Started server at port " + port + ".");
});

That might work fine for HTML files, but if you try other files, there will be content type mismatch. To get MIME types, we use mime-types package, that you can install using npm install mime-types. We will then use that module, along with path module to get file extension. The code will look like this:

server.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
//Adding MIME type support...
var http = require("http");
var fs = require("fs");
var mime = require("mime-types");
var path = require("path");
var port = 8080;
var server = http.createServer(function (req, res) {
  var filename = "." + req.url;
  filename = filename.replace(/\\/g,"/").replace(/\/\.\.?(?=\/|$)/g,"/").replace(/\/+/g,"/"); //Poor mans URL sanitizer
  if(filename == "./") filename = "./index.html";
  var ext = path.extname(filename).substr(1); //path.extname gives "." character, so we're using substr(1) method.
  fs.readFile(filename, function(err, data) {
    if(err) {
      if(err.code == "ENOENT") {
        //ENOENT means "File doesn't exist"
        res.writeHead(404, "Not Found", {
          "Content-Type": "text/plain"
        });
        res.end("404 Not Found");
      } else {
        res.writeHead(500, "Internal Server Error", {
          "Content-Type": "text/plain"
        });
        res.end("500 Internal Server Error! Reason: " + err.message);
      }
    } else {
      res.writeHead(200, "OK", {
        "Content-Type": mime.lookup(ext) || undefined
      });
      res.end(data);
    }
  });
});
server.listen(port, function() {
  console.log("Started server at port " + port + ".");
});

But with query strings, it will fail. To prevent that, we’ll be using WHATWG URL parser (url.parse is now deprecated):

server.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
//And URL query...
var http = require("http");
var fs = require("fs");
var mime = require("mime-types");
var path = require("path");
var port = 8080;
var server = http.createServer(function (req, res) {
  var urlObject = new URL(req.url, "http://localhost");
  var filename = "." + urlObject.pathname;
  filename = filename.replace(/\\/g,"/").replace(/\/\.\.?(?=\/|$)/g,"/").replace(/\/+/g,"/"); //Poor mans URL sanitizer
  if(filename == "./") filename = "./index.html";
  var ext = path.extname(filename).substr(1); //path.extname gives "." character, so we're using substr(1) method.
  fs.readFile(filename, function(err, data) {
    if(err) {
      if(err.code == "ENOENT") {
        //ENOENT means "File doesn't exist"
        res.writeHead(404, "Not Found", {
          "Content-Type": "text/plain"
        });
        res.end("404 Not Found");
      } else {
        res.writeHead(500, "Internal Server Error", {
          "Content-Type": "text/plain"
        });
        res.end("500 Internal Server Error! Reason: " + err.message);
      }
    } else {
      res.writeHead(200, "OK", {
        "Content-Type": mime.lookup(ext) || undefined
      });
      res.end(data);
    }
  });
});
server.listen(port, function() {
  console.log("Started server at port " + port + ".");
});

It’s nearly finished! But encoded URLs will not work. To fix that, we will use decodeURIComponent() method:

server.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
//And URL decoding...
var http = require("http");
var fs = require("fs");
var mime = require("mime-types");
var path = require("path");
var port = 8080;
var server = http.createServer(function (req, res) {
  var urlObject = new URL(req.url, "http://localhost");
  var filename = "";
  try {
    filename = "." + decodeURIComponent(urlObject.pathname);
  } catch(ex) {
    //Malformed URI means bad request.
    res.writeHead(400, "Bad Request", {
      "Content-Type": "text/plain"
    });
    res.end("400 Bad Request");
    return;
  }
  filename = filename.replace(/\\/g,"/").replace(/\/\.\.?(?=\/|$)/g,"/").replace(/\/+/g,"/"); //Poor mans URL sanitizer
  if(filename == "./") filename = "./index.html";
  var ext = path.extname(filename).substr(1); //path.extname gives "." character, so we're using substr(1) method.
  fs.readFile(filename, function(err, data) {
    if(err) {
      if(err.code == "ENOENT") {
        //ENOENT means "File doesn't exist"
        res.writeHead(404, "Not Found", {
          "Content-Type": "text/plain"
        });
        res.end("404 Not Found");
      } else {
        res.writeHead(500, "Internal Server Error", {
          "Content-Type": "text/plain"
        });
        res.end("500 Internal Server Error! Reason: " + err.message);
      }
    } else {
      res.writeHead(200, "OK", {
        "Content-Type": mime.lookup(ext) || undefined
      });
      res.end(data);
    }
  });
});
server.listen(port, function() {
  console.log("Started server at port " + port + ".");
});

There is still one problem - the leak of “server.js” file. We can add a condition:

server.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
//Source code leakage mitigated, but THERE IS A "%00" PROBLEM!
var http = require("http");
var fs = require("fs");
var mime = require("mime-types");
var path = require("path");
var os = require("os");
var port = 8080;
var server = http.createServer(function (req, res) {
  var urlObject = new URL(req.url, "http://localhost");
  var filename = "";
  try {
    filename = "." + decodeURIComponent(urlObject.pathname);
  } catch(ex) {
    //Malformed URI means bad request.
    res.writeHead(400, "Bad Request", {
      "Content-Type": "text/plain"
    });
    res.end("400 Bad Request");
    return;
  }
  filename = filename.replace(/\\/g,"/").replace(/\/\.\.?(?=\/|$)/g,"/").replace(/\/+/g,"/"); //Poor mans URL sanitizer
  if(filename == "./") filename = "./index.html";
  var ext = path.extname(filename).substr(1); //path.extname gives "." character, so we're using substr(1) method.
  if(filename == ("./" + path.basename(__filename)) || (os.platform() == "win32" && filename.toLowerCase() == ("./" + path.basename(__filename)).toLowerCase())) {
    //Prevent leakage of server source code
    res.writeHead(403, "Forbidden", {
      "Content-Type": "text/plain"
    });
    res.end("403 Forbidden");
    return;
  }
  fs.readFile(filename, function(err, data) {
    if(err) {
      if(err.code == "ENOENT") {
        //ENOENT means "File doesn't exist"
        res.writeHead(404, "Not Found", {
          "Content-Type": "text/plain"
        });
        res.end("404 Not Found");
      } else {
        res.writeHead(500, "Internal Server Error", {
          "Content-Type": "text/plain"
        });
        res.end("500 Internal Server Error! Reason: " + err.message);
      }
    } else {
      res.writeHead(200, "OK", {
        "Content-Type": mime.lookup(ext) || undefined
      });
      res.end(data);
    }
  });
});
server.listen(port, function() {
  console.log("Started server at port " + port + ".");
});

Oh no! Our server may be vulnerable to null byte injection! You can remove null bytes and “%00”, like this:

server.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
//Null byte injection mitigated!
var http = require("http");
var fs = require("fs");
var mime = require("mime-types");
var path = require("path");
var os = require("os");
var port = 8080;
var server = http.createServer(function (req, res) {
  var urlObject = new URL(req.url, "http://localhost");
  var filename = "";
  try {
    filename = "." + decodeURIComponent(urlObject.pathname);
  } catch(ex) {
    //Malformed URI means bad request.
    res.writeHead(400, "Bad Request", {
      "Content-Type": "text/plain"
    });
    res.end("400 Bad Request");
    return;
  }
  filename = filename.replace(/\\/g,"/").replace(/\0|%00/g,"").replace(/\/\.\.?(?=\/|$)/g,"/").replace(/\/+/g,"/"); //Poor mans URL sanitizer
  if(filename == "./") filename = "./index.html";
  var ext = path.extname(filename).substr(1); //path.extname gives "." character, so we're using substr(1) method.
  if(filename == ("./" + path.basename(__filename)) || (os.platform() == "win32" && filename.toLowerCase() == ("./" + path.basename(__filename)).toLowerCase())) {
    //Prevent leakage of server source code
    res.writeHead(403, "Forbidden", {
      "Content-Type": "text/plain"
    });
    res.end("403 Forbidden");
    return;
  }
  fs.readFile(filename, function(err, data) {
    if(err) {
      if(err.code == "ENOENT") {
        //ENOENT means "File doesn't exist"
        res.writeHead(404, "Not Found", {
          "Content-Type": "text/plain"
        });
        res.end("404 Not Found");
      } else {
        res.writeHead(500, "Internal Server Error", {
          "Content-Type": "text/plain"
        });
        res.end("500 Internal Server Error! Reason: " + err.message);
      }
    } else {
      res.writeHead(200, "OK", {
        "Content-Type": mime.lookup(ext) || undefined
      });
      res.end(data);
    }
  });
});
server.listen(port, function() {
  console.log("Started server at port " + port + ".");
});

We have now very simple HTTP static server, serving at localhost:8080.

Wait… Did we forget about SVR.JS? SVR.JS is a web server running on Node.JS, that supports not only static file serving, but also directory listings, path rewriting, complete URL sanitation, HTTPS, HTTP/2.0, expandability via mods and server-side JavaScript, and it’s configurable.