jowavp / sap-cf-features

Read SAP CF feature flags in nodejs

sap-cf-features

NodeJS Library to read the features of the feature-flag-service on SAP Cloud Foundry.

Installation

using npm:

$ npm i sap-cf-features

Example

You can follow this blog post to get an example application on your trial account. https://blogs.sap.com/2020/07/01/library-for-feature-flags-in-nodejs-on-cloud-foundry/

Read a feature-flag

    const {getFeatureFlags, getFeatureFlag, getFeatureFlagBoolean, getFeatureFlagString} = require('sap-cf-features');

    // get all feature flags
    const featureFlags = await getFeatureFlags(undefined, "tenantName");
    // get some feature flags
    const featureFlags = await getFeatureFlags(["feature-1", "feature-2"], "tenantName");
    // get one feature flag value
    const featureFlagValue = await getFeatureFlag("feature-1", "tenantName");
    const featureFlagValueBoolean = await getFeatureFlagBoolean("feature-1", "tenantName");
    const featureFlagValueString = await getFeatureFlagString("feature-2", "tenantName");
    

add the feature flag to your nodejs express app

    const {featureFlagRouter} = require('sap-cf-features');

    /**
     *  function to identify the identifier.
     *  @param req Request object
     *  @returns the identifier (string)
     */

    const identifierFn = (req) => req.authInfo.subdomain;

    app.use("/feature-flags", featureFlagRouter(identifierFn));

sap-cf-features's Issues

Follow-redirects axios dependency is vulnerable

Is your feature request related to a problem? Please describe.

The axios is being blocked by white source, because the follow-redirects dependency is vulnerable.

Affected versions of this package are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

Describe the solution you'd like

It was already fixed by axios here. Can you update the axios version to the latest, please?

sap/approuter 11.0.0 crashes sporadically using featureFlags middleware

Hi Joachim,
using latest @sap/approuter 11.0.0 i am getting crashes like

TypeError: Cannot read properties of undefined (reading 'tenant')
at /home/vcap/deps/0/node_modules/sap-cf-features/dist/index.js:129:57

using it this way
xs-security.json: "tenant-mode": "dedicated",
approuter.js: .use('/featureFlags', featureFlagRouter((req) => req.user.tenant, true))

It worked like a charm with previous version of approuter.

Maybe SAP changed something internally.
I am also using node v16 instead v14, introduced/updated with v11.
Maybe that is the reason?

Would be great, if you can catch this inside your code.
The exection is comming sporadically and the the approuter crashed and gets restarted.
I do not know the exact situation, when this happens. Just saw the log in CF.

Best regards
Holger