<commit_before>/**
 * Copyright (c) 2014 "Fronteer LTD"
 * Grasshopper Event Engine
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as
 * published by the Free Software Foundation, either version 3 of the
 * License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */

var _ = require('lodash');
var bodyParser = require('body-parser');
var cookieParser = require('cookie-parser');
var cookieSession = require('cookie-session');
var express = require('express');
var http = require('http');
var passport = require('passport');
var util = require('util');

var AppsDAO = require('gh-apps/lib/internal/dao');

var DB = require('./db');
var log = require('./logger').logger('gh-core/server');

var safePathPrefixes = [];

/**
 * Start an Express server on the specified port. This will be done for both the global admin server and
 * the app server
 *
 * @param  {Number}     port        The port on which the Express server should be started
 * @param  {Object}     config      The application configuration
 * @return {Express}                The created express server
 */
var setUpServer = module.exports.setUpServer = function(port, config) {
    // Create the express server
    var app = express();

    // Expose the HTTP server on the express app server so other modules can hook into it
    app.httpServer = http.createServer(app);

    // Start listening for requests
    app.httpServer.listen(port, 'localhost');

    // Don't output pretty JSON
    app.set('json spaces', 0);

    // Don't output the x-powered-by header
    app.set('x-powered-by', false);

    // Grasshopper uses cookies to hash the user id.
    // Signing the cookie will be done by session middleware
    app.use(cookieParser(config.cookie.secret));

    /*!
     * Grasshopper supports the following type of request encodings:
     *
     *  * urlencoded (regular POST requests)
     *  * application/json
     *  * TODO: multipart (file uploads)
     *
     * A maximum limit of 250kb is imposed for `urlencoded` and `application/json` requests. This limit only
     * applies to the *incoming request data*. If the client needs to send more than 250kb, it should consider
     * using a proper multipart form request
     */
    app.use(bodyParser.urlencoded({'limit': '250kb', 'extended': true}));
    app.use(bodyParser.json({'limit': '250kb'}));

    // This needs to come BEFORE passport and AFTER cookieParser. The secret will be used to sign the cookie
    app.use(cookieSession({'secret': config.cookie.secret}));<commit_msg>Trust the reverse proxy<commit_after>/**
 * Copyright (c) 2014 "Fronteer LTD"
 * Grasshopper Event Engine
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as
 * published by the Free Software Foundation, either version 3 of the
 * License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */

var _ = require('lodash');
var bodyParser = require('body-parser');
var cookieParser = require('cookie-parser');
var cookieSession = require('cookie-session');
var express = require('express');
var http = require('http');
var passport = require('passport');
var util = require('util');

var AppsDAO = require('gh-apps/lib/internal/dao');

var DB = require('./db');
var log = require('./logger').logger('gh-core/server');

var safePathPrefixes = [];

/**
 * Start an Express server on the specified port. This will be done for both the global admin server and
 * the app server
 *
 * @param  {Number}     port        The port on which the Express server should be started
 * @param  {Object}     config      The application configuration
 * @return {Express}                The created express server
 */
var setUpServer = module.exports.setUpServer = function(port, config) {
    // Create the express server
    var app = express();

    // Expose the HTTP server on the express app server so other modules can hook into it
    app.httpServer = http.createServer(app);

    // Start listening for requests
    app.httpServer.listen(port, 'localhost');

    // Don't output pretty JSON
    app.set('json spaces', 0);

    // Don't output the x-powered-by header
    app.set('x-powered-by', false);

    // We should always be running behind a load balancer like Nginx or Apache so we can
    // trust the X-Forwarded-* headers
    app.enable('trust proxy');

    // Grasshopper uses cookies to hash the user id.
    // Signing the cookie will be done by session middleware
    app.use(cookieParser(config.cookie.secret));

    /*!
     * Grasshopper supports the following type of request encodings:
     *
     *  * urlencoded (regular POST requests)
     *  * application/json
     *  * TODO: multipart (file uploads)
     *
     * A maximum limit of 250kb is imposed for `urlencoded` and `application/json` requests. This limit only
     * applies to the *incoming request data*. If the client needs to send more than 250kb, it should consider
     * using a proper multipart form request
     */
    app.use(bodyParser.urlencoded({'limit': '250kb', 'extended': true}));
    app.use(bodyParser.json({'limit': '250kb'}));

    // This needs to come BEFORE passport and AFTER cookieParser. The secret will be used to sign the cookie
    app.use(cookieSession({'secret': config.cookie.secret}));
{'fraction_non_alphanumeric': 0.10239404723390488, 'fraction_numerical': 0.005823358136525397, 'mean_word_length': 3.3788951841359776, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2744619', 'n_tokens_mistral': 1706, 'n_tokens_neox': 1630, 'n_words': 708}