We've got a "catch-all" in app.js that renders a .jade file if it exists:

app.get('*', routes.render);


render: function(req, res) {
  fs.exists('views' + req.url + '.jade', function(exists) {
    if (exists) {
      //substring: "/admin" -> "admin"
    } else {
      res.render('404', {url: req.url});

Problem is, we've either got to move everything we don't want rendered this way into another folder, which is a hassle, or create a manual blacklist. Is there a better way of doing this?

  • \$\begingroup\$ I guess this is only for static pages? \$\endgroup\$ Mar 1 '13 at 19:34
  • \$\begingroup\$ Only for pages that don't require additional parameters (for example "About Us") \$\endgroup\$ Mar 1 '13 at 19:45

Here are some examples of how most apps do:

  • Apache renders everything in the folder. If you want to hide access to a subfolder, you do that with an htaccess in this subfolder.
  • Define each route yourself. This'd mean having a whitelist in your case. (In some array or something.)
  • Keep the routes in the database. This allows you to handle permissions easily.

I haven't often seen the blacklist way. Why? Because of a simple security principle: blacklists may accidentally treat bad input as safe.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.