Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Test if a URL uses Node.js

dotheyusenode.herokuapp.com

Post reply on HN
Print view View original

11–20 of 34 posts

Re: Test if a URL uses Node.js

#11

Post by wlaurance »

laumars wrote: post #7

Pretty pointless since all this does is check the x-powered-by HTTP response header (which can be turned off[1]). If this captured other web frameworks as well (eg PHP also outputs to x-powered-by in it's default config) then this might be a little less pointless - but even then, most production sites should have those information leaks sealed anyway (you don't actually improve security, but at least it slows the att…

It checks x-powered-by and Server in some cases. https://github.com/dotheyusenode/dotheyusenode/blob/master/c...

It also tries to read through the Javascript served up to see if it uses browserify. https://github.com/dotheyusenode/dotheyusenode/blob/master/c...

But yes it is a glorified `curl -I www.foo.com | grep -i 'x-powered-by` UI

Re: Test if a URL uses Node.js

#13

Post by wlaurance »

hayksaakian wrote: post #2

If you can't tell if airbnb uses node, I'm note sure it works at all.

I'm not sure what they are using to serve up their site, other than nginx. But they do have this header, "X-Hi-Human: The AIRBNB SRE team added this header. Come work with us! Email dave+header@airbnb.com"

Re: Test if a URL uses Node.js

#15

Post by laumars »

wlaurance wrote: post #11
laumars wrote: post #7

Pretty pointless since all this does is check the x-powered-by HTTP response header (which can be turned off[1]). If this captured other web frameworks as well (eg PHP also outputs to x-powered-by in it's default config) then this might be a little less pointless - but even then, most production sites should have those information leaks sealed anyway (you don't actually improve security, but at least it slows the att…

It checks x-powered-by and Server in some cases. https://github.com/dotheyusenode/dotheyusenode/blob/master/c... It also tries to read through the Javascript served up to see if it uses browserify. https://github.com/dotheyusenode/dotheyusenode/blob/master/c... But yes it is a glorified `curl -I www.foo.com | grep -i 'x-powered-by` UI

Technically it's more like "curl -i" rather than "-I" since it does a GET request rather than a HEAD request. Which is a good thing as the former is more accurate. There are rare occasions when a web server might be sending wrong headers which get overwritten with the correct headers from the executing code (I think one of OVH's portals suffered from this issue - though that may have since been fixed)

You probably might want to stick "-s" in there too; silence the transfer statistics which curl (annoyingly) adds when output is piped / redirected.

Re: Test if a URL uses Node.js

#16

Post by wlaurance »

laumars wrote: post #15
wlaurance wrote: post #11

Earlier quoted context omitted.

It checks x-powered-by and Server in some cases. https://github.com/dotheyusenode/dotheyusenode/blob/master/c... It also tries to read through the Javascript served up to see if it uses browserify. https://github.com/dotheyusenode/dotheyusenode/blob/master/c... But yes it is a glorified `curl -I www.foo.com | grep -i 'x-powered-by` UI

Technically it's more like "curl -i" rather than "-I" since it does a GET request rather than a HEAD request. Which is a good thing as the former is more accurate. There are rare occasions when a web server might be sending wrong headers which get overwritten with the correct headers from the executing code (I think one of OVH's portals suffered from this issue - though that may have since been fixed) You probably mi…

I should clarify that I am using the request module to make GET requests on the url submitted. But yes, I dislike that the curl stats print by default when output is redirected :/

Re: Test if a URL uses Node.js

#18

Post by mattgreenrocks »

camus2 wrote: post #3
hayksaakian wrote: post #2

If you can't tell if airbnb uses node, I'm note sure it works at all.

I guess it's just checking for some header,like express has a special header... by the way, framework authors, please refrain from doing stuffs like that. The framework i use is nobody's business but mine.

It's also dangerous and irresponsible from a security standpoint. Not advocating security by obscurity, but advertising it doesn't help.

Re: Test if a URL uses Node.js

#19

Post by laumars »

wlaurance wrote: post #16
laumars wrote: post #15

Earlier quoted context omitted.

Technically it's more like "curl -i" rather than "-I" since it does a GET request rather than a HEAD request. Which is a good thing as the former is more accurate. There are rare occasions when a web server might be sending wrong headers which get overwritten with the correct headers from the executing code (I think one of OVH's portals suffered from this issue - though that may have since been fixed) You probably mi…

I should clarify that I am using the request module to make GET requests on the url submitted. But yes, I dislike that the curl stats print by default when output is redirected :/

> I should clarify that I am using the request module to make GET requests on the url submitted.

Yeah I saw (I had a browse through your source after your previous post).

As a side note, I was impressed with just how readable your code was (even for someone like myself with very poor Javascript skills). I can't comment on how much credit node.js deserves for that, but I've seen people turn even the most readable of languages into line noise in the past. So it's always a pleasure to read code that doesn't require lines of comments to explain their function.

Post reply on HN