Question

My site is powered by node & using the Express framework.
My goal is to setup a proxy to get data from the Yahoo Placefinder api (because they do not offer a JSONP response).
I want to send jquery ajax requests to the proxy and get back the PlaceFinder api response.

Here is my express route:

app.get('/placefinder/:curr_address', function (req, res) {

var options = {
    host: 'where.yahooapis.com',
    port: 80,
    path: '/geocode?location=' + req.params.curr_address + '&flags=J&appid=[put app id here]'
};

var req = http.get(options, function (res2) {
    console.log("Got response: " + res2.statusCode);

    res2.setEncoding('utf8');
    res2.on('data', function (chunk) {
        console.log('BODY: ' + chunk);

        res.render('response', {
            response: chunk
        }); // res.render
    }); // on
}); // req
req.on('error', function (e) {
    console.log("Got error: " + e.message + "... path: " + options.host + options.path);
});
// write data to request body
req.write('data\n');
req.write('data\n');});

The above code is working. For example, I can visit mywebsite.com/placefinder/123+fake+street,90210 and the response from the PlaceFinder api will be displayed.

The issue is that everyone can visit that page and get the response from the PlaceFinder api. I don’t want that. I only want my (ajax) scripts have access.

1. How can I use some basic authentication to permit only my ajax requests to access mywebsite.com/placefinder/123+fake+street,90210 … I’ve never used basic authentication and I can’t figure out how to apply it to this case.

2. Or, is there some way I can block the placefinder directory from all outside access (kind of like apache .htacess)?

Answer 1

How can I use some basic authentication to permit only my ajax
requests to access mywebsite.com/placefinder/123+fake+street,90210 …
I’ve never used basic authentication and I can’t figure out how to
apply it to this case.

I don’t think you should be using basic auth, but use sessions instead. TJ does have example available how to use session at https://github.com/visionmedia/express/tree/master/examples/session. There are a lot more examples available you should study. Connect does also have a middleware to handle basic auth though. I don’t like this approach, because it is not that safe especially when not used behind SSL.

Or, is there some way I can block the placefinder directory from all
outside access (kind of like apache .htacess)?

In node.js every app runs in a separate process. You could just bind to just that host instead of INADDR_ANY.

app.listen([port[, host]])

Bind the app server to the given port, which defaults to 3000. When
host is omitted all connections will be accepted via INADDR_ANY.

app.listen(); app.listen(3000); app.listen(3000, ‘n.n.n.n’);

You could also Use node.js with NGinx. Than you for example use something like https://serverfault.com/questions/183884/nginx-protect-directory-with-password-except-for-specific-ips/183939#183939. NGinx is very powerful.