Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

- a little hack to enable custom request decryption #86

Open
wants to merge 6 commits into
base: master
Choose a base branch
from

Conversation

vietanh85
Copy link

  • Sometime we need to encrypt response and request from client to server to ensure security

@vietanh85 vietanh85 changed the title - a little hack to enable custom request description - a little hack to enable custom request decryption Mar 25, 2015
@dougwilson
Copy link
Contributor

Makes sense. Can the decryption be done as a stream instead of a sync decryption?

@dougwilson dougwilson added the pr label Mar 25, 2015
@dougwilson dougwilson self-assigned this Mar 25, 2015
@vietanh85
Copy link
Author

Since, we are using raw-body to convert request stream to a buffer. In addition, I've learned that, there is no way to modify a readable stream in nodejs. So I think we cannot decrypt a stream.

@dougwilson
Copy link
Contributor

I'm talking about changing the interface here to take a TransformStream, rather than do it prior to calling this module.

@dougwilson
Copy link
Contributor

Ok, sorry we misunderstood. The user needs to pass in a TransformStream as the decrypt argument. What we have here is still the same DoS vector.

@dougwilson
Copy link
Contributor

And if possible, please add tests and make sure decryption occurs after inflation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants