Code Review Stack Exchange is a question and answer site for peer programmer code reviews. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We've got a "catch-all" in app.js that renders a .jade file if it exists:

app.get('*', routes.render);


render: function(req, res) {
  fs.exists('views' + req.url + '.jade', function(exists) {
    if (exists) {
      //substring: "/admin" -> "admin"
    } else {
      res.render('404', {url: req.url});

Problem is, we've either got to move everything we don't want rendered this way into another folder, which is a hassle, or create a manual blacklist. Is there a better way of doing this?

share|improve this question
I guess this is only for static pages? – Florian Margaine Mar 1 '13 at 19:34
Only for pages that don't require additional parameters (for example "About Us") – SomeKittens Mar 1 '13 at 19:45

Here are some examples of how most apps do:

  • Apache renders everything in the folder. If you want to hide access to a subfolder, you do that with an htaccess in this subfolder.
  • Define each route yourself. This'd mean having a whitelist in your case. (In some array or something.)
  • Keep the routes in the database. This allows you to handle permissions easily.

I haven't often seen the blacklist way. Why? Because of a simple security principle: blacklists may accidentally treat bad input as safe.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.