►
Description
Workshop: Node.js Help Alive! - Gireesh Punathil, IBM & Anna Henningsen, NearForm
You may have used the Node.js help repo to ask questions and get help from any one of the great collaborators who regularly contribute there. This workshop takes that a step further. Come get help in a live format where we'll hold a Node.js clinic as an open platform for developers using Node.js to seek resolutions for issues they are facing in their node projects. We will bring in experienced developers of the Node.js open source community (some of the same ones who contribute answers in the Node.js help repo), who will review your issues and provide recommendations to resolve them, on site at the workshop. You can bring any issue, ranging from common questions on programming semantics to production anomalies, and from deployment specific tunables to architectural considerations.
A
Well,
maybe
just
like
in
trees
us
for
like
10
seconds,
so
we're
Gyrich
and
I'm
Anna,
and
we
work
on
node
core
and
we
are
two
of
the
people
who
try
to
answer
questions
and
the
note.
G
s
slash,
help
repository
on
get
up,
and
so
that
is
kind
of
the
idea
of
this
worship
here,
trying
to
find
people
who
might
have
issues
with
Noches
and
help
them
get
get
answers
to
their
questions.
B
Thanks
Anna,
so
for
me
this
is
first
of
its
kind
event.
That's
happening,
so
please
feel
free
to
provide
any
feedback
in
terms
of
the
expectations
if
it
is
not
matching
in
terms
of
the
content
or
in
terms
of
you
know
the
details
and
things
like
that,
we
can
always
improve
on
that.
But
for
me,
what
is
most
important
is
for
the
node.js
ecosystem.
B
So
combining
these
two
groups
together,
the
whole
idea,
is
to
make
having
meaningful
conversations
and
make
the
node.js
user
experience
have
better
one.
So
that's
the
whole
idea,
that's
the
whole
intent
so
in
that,
in
that
perspective,
I
think
we
are
doing
the
right
thing,
so
please
feel
to
share
the
feedback
if
any.
A
So
a
sense
there
some
will
like
less
than
a
handful
of
people
here
who
I
would
suggest
that
well.
Well,
if
you
like
that,
we
start
by
asking
you
like:
do
you
have
any
issues
or
any
questions
about?
No
just
that
you
brought
with
you
that
you
want
to
ask
and
don't
be
shy
because
you're
not
taking
up
anybody
else's
talking
to
him.
A
A
A
C
A
C
C
A
D
B
You
have
the
back
end
where
the
session
gets
stored,
which
is
highly
customizable.
The
databases
and
other
other
projects
can
implement
their
own
session
store
session.
Basically,
is
an
interface,
and
then
we
have
seen
few
issues
coming
from
the
session
rapport
in
terms
of
the
session
not
getting
persister
when
you
are
redirecting
the
URL
and
sometimes
the
session
gets
deleted
across
the
routes.
Ok,
yeah.
B
A
D
C
C
B
A
C
C
C
C
C
C
C
D
D
C
C
C
C
A
A
A
C
A
B
B
So,
ideally,
the
session
object
gets
persisted
between
the
redirects,
but
we
have
seen
many
issues
on
that
line.
One
one
known
issue
which
is
related
to
some
race
conditions.
Is
that
suppose
a
scenario
where
you
have
a
session
store,
which
is
a
remote
machine
like
a
MongoDB
or
whatever,
which
is
across
the
network
and
then
the
contract
with
the
session
API
is
that
every
time
you
send
the
response
back
to
the
client?
That's
the
time
this
session
gets
stored
automatically
to
the
session
store.
B
Now
the
response
go
to
the
client,
the
session
go
to
be
a
session
store
right.
These
are
two
separate
Network
requests.
Now
what
if
the
client
comes
back
with
the
second
request,
immediately,
meaning
back
to
back
the
second
request,
which
assumes
that
your
session
is
already
persisted
and
is
available
in
the
server
in
its
modified
form.
But
then
there
is
a
round-trip
network,
latency,
that's
involved
and
the
dependence
on
the
proximity
of
the
session
store
with
respect
to
the
client
machine
and
all
other
network.
C
C
C
E
You
you
I,
don't
know
if
this
would
be
appropriate
to
ask
here,
but
once
we're
done
with
this
or
at
at
some
another
point,
would
you
guys
be
able
to
answer
any
questions
around
like
just
a
brief?
What's
happening
with
ESM
modules
like
I
know
that
they
just
got
removed
from
the
flag
but
I'm,
basically
confused
about
what
the
future
of
esm
a
node
and
what
you
know,
how
that's
going
to
work
or
yeah.
E
A
B
Okay,
so
here
is
an
example
code
for
your
reference.
I
can
walk
you
through
this
first,
let's
look
at
the
client
side.
There's
the
client
side
code
in
the
app
dot,
listen
callback,
I
start
one
client,
which
is
accessing
the
main
route
and
in
the
callback
of
the
first
request.
I
am
making
a
second
because
so
just
to
make
sure
that
both
the
requests
get
the
proper
session
object
reflector
in
there.
B
Now,
if
you
look
at
this
server
code,
you
create
a
session
here.
Well,
no
one
save
uninitialized
set
of
holes
receive
a
set
of
Falls
and
a
max
age
of
one
minute.
The
default
route
I
create
a
session
object
and
set
the
views
to
some
value
and
then
send
the
response,
but
if
it
is
not
the
default
case,
that
is
not,
for
the
first
time,
I
increment
the
session
and
add
some
extra
value
to
the
session.
B
There's
only
done
in
the
second
time
onwards,
and
instead
of
simply
redirecting
to
the
next
route,
which
is
here
I,
do
it
basically
I
do
an
explicit,
save
and
then
in
the
callback
I.
Do
the
redirection
at
this
point
line
number
29.
It's
guaranteed
that
whatever
the
session
store
implementation
is
a
database
or
memory
store
or
whatsoever.
At
this
point,
the
session
is
actually
persistent.
So
then,
when
you
actually
land
up
on
the
admin
route,
you
actually
get
the
latest
value,
so
maybe
something
you
can
drive
it
like.
A
A
B
B
B
Yeah
so,
as
you
can
see,
most
of
the
Express
modules,
including
the
session,
have
a
lot
of
debug
statements
printed
across
the
you
know.
Vital
control
flow
points.
That
means
to
say
the
life
cycle
of
the
session
when
it
is
getting
persisted
when
it
is
recreator
and
things
like
that,
so
they
they
print
a
very
useful
debug
message.
The
only
thing
you
need
to
do
is
before
starting
just
export.
This
right.
A
A
A
So
my
current
understanding
so
like
the
feature
is
still
considered
experimental,
but
the
flag
has
been
removed.
There
are
still
experimental
flags
for
some
sub
features
like
I.
Think,
like
the
the
VM
part
like
the
in
the
VM
module
of
noches,
the
part
that
is
concerned
with
modules
or
I
think
the
loader
is
still
experimental,
like
the
loader
API.
A
D
A
Yeah
like
like
yes,
I'm,
seeing
execution
can
be
asynchronous
and
well
well,
require
a
synchronous
and
that
kind
of
just
doesn't
match
up
and
that
PR
kind
of
like
hacks
around
that
in
some
ways
that
you
should
not
do
the
other
way
around,
like
we
importing
common
J's
from
es
modules
that
works,
but
only
for
the
default
export,
and
there
are
some
like
I,
don't
think,
there's
a
really
good
way
around
that
right.
Now,
I
think
the
most
like
the
solution
that
the
module
seems
going
for
is
I
understand.
A
It
is
for
now
that
you
can
create
some
kind
of
wrapper
module
that
it's
an
DSM
and
that
bloats
that
commonjs
file
and
then
we
exports
everything
which
you
know
I,
guess
that
works
well
enough.
There
are
some
features
being
added
to
package
that
Jason
that
are
very
relevant
here,
so
you
can
so
for
one
there's
a
type
flag
that
can
be
set
to
module
or
I.
A
Don't
know
I
guess
something
else
not
Mario
and
the
type
like
would
tell
you
that
like
if
it
is
type
module,
then
dot
J's
files
are
going
to
be
interpreted
as
ESM
so
like
that.
That
is
the
solution
for
not
having
to
use
that
MJS
again
as
I
understand
it.
I'm
not
part
of
the
module,
seem
I
just
like
try
to
observe
what
they
do
and
have
strong
opinions
about
that
that
I
try
to
not
express,
because
that
gets
frustrating
I,
don't
know
what
I
was
there
with.
Is
that.
D
B
E
E
F
E
A
Yeah,
but
like
more
specifically
to
a
question
like
like
man
is
standing.
Is
that
Babel
the
support
ESM
like
in
a
spec
compliant
way,
but
the
spec
we've
some
options
open
for
what
the
implementation
does,
and
so
the
yeah
one
of
the
main
issues
and
that
I'm
really
unhappy
about
that.
We
didn't
find
a
solution
so
far,
right
at
least
not
that
everybody's
happy
with.
Is
that
the?
Why
bottled
us
and
what
note
currently
does
are
not
compatible
like
you?
A
D
F
A
E
F
A
E
D
E
No
js'.
This
has
been
really
confusing
to
me
in
terms
of
like
whether
what
I'm
gonna
have
to
end
up
doing
in
order
to
change
my
the
JavaScript
I
ride
or
if
I
need
to,
but
it
sounds
like,
as
of
today,
we're
can
still
using
babble,
etc.
But
though
a
module
group
is
working
hard
to
smooth
out
issues
so
that
we
can
use
it
natively.
Sometimes.
A
D
D
F
A
D
A
A
A
Yeah,
like
I
I'm,
also
like
in
the
unfortunate
position
that
I've
never
actually
used,
typescript
for
anything
and
I
really
wish.
We
like
I
personally,
would
love
to
have
that
in
mid
court
at
this
point,
because
it
would
definitely
have
caught
a
few
bugs
early,
but
yeah
I.
Don't
really
think
I
like.
A
A
A
A
Like
the
current
screams,
API
version
is
3,
yes,
but
like
it,
my
I
mean
like
they
are
all
exist.
At
the
same
time
like
it's
somewhere
somewhere,
backwards-compatible
scream
was
basically
just
omitting
events
like
omitting
data
events
on
a
scream,
I
think
that
was
pretty
much
it
I,
like
no
internals
in
any
way,
like
whatever
implemented.
That
interface
was
screams
and
screams.
A
But
I
don't
see
many
people
using
that
in
practice,
we
can
study
on
data
is
still
kind
of
very
useful
and
there
are
some
things
being
worked
on
like
Jeremiah.
Sankyo
is
working
like
at
Fish
Rock,
one
two
three.
This
is
Hannah
and
he's
working
or
he
had
been
working
on
a
replacement,
screams
API.
That
would
kind
of
be
more
low-level
and
have
less
overhead,
like
one
of
the
things
that
annoy
that's
annoying
about
no
just
car
services
that
they
do
have
some
overhead
that
you
know
wouldn't
be
necessarily
in
in
an
ideal
world.
D
A
B
I'm,
not
an
SME
in
the
streams,
but
my
perspective,
probably
outsider's
view
to
the
streams,
is
that
node.js
is
possibly
the
first
platform
or
language
which
has
the
streams
implemented
at
the
language
API
level
itself,
which
works
well
with
the
asynchronous
even
driven
programming
model.
Other
languages
like
C++
or
Java,
or.net,
etc.
Will
have
this
as
an
additional
capability,
not
fused
into
the
semi.
So
because
of
the
odd
I
mean
because
of
that
it's
an
added
advantage,
but
the
the
drawback
is.
B
D
G
B
A
Yeah
I
mean
it's
tricky
I'd,
like
you
probably
also
have
seen
like.
We
have
a
collaborator
or
not
yet
collaborator,
probably
hopefully
soon,
who
did
a
lot
of
work
around
the
screams
over
the
last
month
and
like
he
opened
so
many
issues
on
the
note,
Cory
perk
that
we're
all
about
like
yeah
ordering
of
lifecycle
events
are
like
yep,
just
like
figuring
out
what
the
actual
edge
cases
are.
What
the
interactions
of
the
different
parts
of
screams
are
is
there's
so
many
unanswered
questions
at
this
point
with
the
current
API.
A
I
also,
like
I,
find
it
super
interesting
that
there's
this
pattern
that,
like
a
lot
of
no
J's
features,
eventually
end
up
being
provided
by
browsers
at
some
point,
but
like
in
a
very
different
and
kind
of
clear
manner
like,
for
example,
buffers
which
eventually
became
you
and
at
erase
and
stuff
like
that
or
string
denotes
screen
decoder,
which
browsers
provide
us
text
decoder
now
and
screams.
You
know,
I
I
feel
like
what
WG
screams
are
nicer
more
like
well-defined
API.
E
C
On
my
own
after
I
get
the
session
variables
working
I
don't
have
anything
in
there
for
security.
Currently,
so
I
don't
know
offend,
you
guys
know
the
best
way
to
proceed.
I
haven't
even
searched
around
to
be
honest,
I
just
I'm,
looking
for
some
early
guidance
on
how
to
properly
and
been
most
beneficial
II.
Do
that
within
my
node.js
application,
I
mean.
C
C
C
C
B
Yeah
I
mean
at
at
high
level.
I
would
say
that
node.js
Babar
being
in
the
backend
being
always
serving
services.
He
is
centrally
located
in
terms
of
the
security
vulnerabilities,
but
at
the
same
time,
when
it
comes
to
the
security
posture,
we
already
look
at
two
aspects.
One
is
what
is
the
type
of
your
application?
Are
you
trusting
everything
that
the
program
contains?
B
C
B
What
is
a
trust
that
is
established
between
these
stack
modules?
There
are
I
guess
there
were
huge
discussions
that
happen
in
2017
node.js
interact,
you
should
we
trust
the
npm
modules
or
shouldn't
be.
If
you
don't
trust
the
npm
modules,
then
we
need
to
implement
the
security
constraints
right
in
the
current
time
itself.
But
if
you,
if
you
trust
the.
B
Like
put
proper
security
audits
and
proper
reviews,
and
things
like
that,
then
the
default
security
constraints
that
is
available
in
the
runtime
applies
across
the
board.
All
the
node,
all
the
JavaScript
modules
come
under
the
purview
of
that
and
then
I
mean.
Then
you
just
need
to
worry
about
the
other.
B
The
vulnerabilities
which
are
available
in
the
networking
session,
like
the
cross-site
scripting,
the
session
hijacking,
and
things
like
that,
I
guess
the
default
behavior
or
the
default
implementation
of
all
the
experts
and
its
sub
modules
have
very
good
security
coverage
in
terms
of
the
web,
app
security,
and
so
that
boils
down
to
the
runtime
security
alone.
In.
D
B
D
C
A
If
I
can
find
it
online
anyway,
like
I
I
was
at
a
conference
like
earlier
this
year,
where
there
was
a
great
talk
about
HTTP
headers
and
how
they
affect
security.
Maybe
they
have
a
link
to
their
YouTube
channel
here
or
something,
if
not
they're,
not
I,
don't
he
was
the
dude.
They
gave
the
talk
and
okay
yeah
I,
don't
anyway,.
A
Okay,
yeah
anyway,
like
there's
a
lot
of
HTTP
headers
that
are
concerned
with
things
like
security
and
like
you,
since
you
mentioned
cross-site
scripting
like
if
that
is
one
of
your
concerns,
then
there's
always
measures
that
you
can
take
to
mitigate
this
like
reuse.
These
seriousness
of
this
attack,
vector
and
like
I,
don't
know,
there's
probably
good
resources
on
the
relevant
HTTP
headers
out
there
up
to
right.
D
B
Thanks
one
other
thing
which
I
think
the
Express
or
any
middleware
component
and
in
prove
one,
is
to
document
the
security
implications
of
different
usage
of
the
modules,
for
example,
if
your
application
is
not
redirecting
or
not
making
use
of
the
session,
then
the
session
hijacking
is
not
coming
into
the
picture.
Maybe
for
people
who
are
well
understood
in
the
art
it
might
become
trivial,
but
for
a
new
programmer
or
an
application,
normal
application
programmer.
These
kinds
of
mapping
really
helps
a
lot.
For
example,
what
is
the
nature
of
your
application?
B
C
Yeah
so
I
see
a
I'm
just
on
the
note
security
page
and
it
says
that
you
can
report
third-party
module
bugs
to
the
security
working
group
repository
hacker
1.
Yes,
so
anybody
ever
had
problems
with
the
third-party
node
modules
or
our
modules.
Third-Party
modules
I
mean
not
anybody
in
the
world
but
like
and
your
guys
experienced
anyone.