res.statusMessage = 'Page not found';

res.write(body); -- assuming the body is a big string of HTML...

res.end(); ... without a string or res.end(rest_of_body) ... assuming rest_of_body is more HTML.

You need to require the express package

    const express = require('express');
    const app = express();

Then start your express server.

    const port = 8000;
    app.listen(port, () => console.log(`App listening on port ${port}...`));

    app.get('/', (req, res) => {
        res.send('Hello World!');
    });

Use pattern matching to match HTTP request paths to route handlers

The following path matches /pictures followed by anything: /pictures/summer, /pictures/prom

    app.get(/^\/pictures\/.+$/i, (req, res) => {
        res.send('Here are some pictures');
    });

    app.get('/pictures/:id(\\d+)', (req, res) => {
        res.send('Here is a single picture');
    });

    html
        head
            title Pug Demo
        body
            h1 Pug Demo
            h2 Pug allows you to do many things
            ul
                li: a(href='google.com') This is a link to a google.com
                li: span.yellow This is a span with class='yellow'
            h2 And now some colors

1. Create a json object and pass it back to the template using res.render
2. In the template, use:
1. #{varName} in a string for interpolation
2. use '=' assignment and varName (li= color) when assigning the value

    app.get('/pug', (req, res) => {
        res.rendjer('eod', {
            title: 'EOD demo',
            header: 'Pug demo',
            colors: ['blue', 'red', 'green']});
        });

    html
      head
        title= title
        style
          include style.css
      body
        h1 This is the #{header} page which does string interpolation.
        p
         - const a = 1 + 2; //Look! we can do inline javascript that doesn't output!
         = `The answer is ${a}` //Look this runs some inline javascript that does output!
        each color in colors
            li= color

In your userRoutes.js file, require the express package, then declare a constant of express.Router

    const express = require('express');
    const userRoutes = express.Router();

    //Because this sub-router is registered on /users "app.use('/users', userRoutes);" in app.js), it will match the route /users/questions
    userRoutes.get('/questions', (req, res) => {
        res.send('Answers');
    });

Then you need to tell app.js that you're going to use these routes:

    app.use('/users', userRoutes);

div#main

div.blue

In your app.js: res.render('layout', { isEOD: true });

In your pug file:

    if isEOD
      h2 Welcome back!
    else
      h2 Keep coding!

First, in the app.js send your dynamic values:

    res.render('layout', {
        title: 'Pug demo page',
        header: 'interpolation'
    });

Then, in your Pug file, interpolate the values received:

    html
      head
        title= title
    body
      h1 Pug does #{header}

First, send your colors array to the Pug file as an object with an array:

    app.get('/pug', (req, res) => {
        res.render('eod', {colors: ['blue', 'red', 'green']});
    });

Then, in your pug file, iterate through the array referenced by the key "colors"

    ul
      each color in colors
        li= color

1. An action, telling it which end point it must hit.
2. A method, telling it which method should be executed

<form action="/users" method="post">

1. absolute URL : https://www.wellsfargo.com/transfers
2. relative URL : /users = localhost:3000/users
3. no URL : Form will be sent to the same page(url) the form is present on

The method attribute defines how the data will be sent?

PUT, DELETE, PATCH or any methods other than GET and POST.

The form data is appended to the body of the HTTP request?

You would have to use AJAX requests using the fetch API, for example.

    form(method="post" action="/users")
      input(type="hidden" name="_csrf" value=csrfToken)
      label(for="username") Username:
      input(type="username" id="username" name="username" value=username)
      label(for="email") Email:
      input(type="email" id="email" name="email" value=email)
      label(for="age") Age:
      input(type="age" id="age" name="age" value=age)
      label(for="password") Password:
      input(type="password" id="password" name="password")
      input(type="submit" vlaue="Sign Up")

CSRF attacks exploit the trust a Web application has in an authenticated user.

Maria, an attacker, wants to trick Alice into sending the money to Maria instead. The attack will comprise the following steps:

1. building an exploit URL or script where Alice's authentication token or login information is stolen.
2. tricking Alice into executing the action with social engineering - for instance, emailing Alice to tell her to change her password at her bank by following this link. Then a fake web page is presented that looks identical to her bank's web page. Alice logs in - but the login information is sent to Maria. Maria then captures her login information, then sends Alice to her bank with the credentials she has just revealed, to complete Alice's login. Maria now, at a later time, can log into to Alice's account with her credentials and drain her accounts.

By using the csrf package available to Node.

1. require the csurf package
2. Setup your express server to use csrfProtection middleware and to use cookies
3. On your html form, create a hidden field which uses a csrfToken
4. On your endpoints, for either get or post, use your csrfProtection middleware

On your express server, use csrfProtection middleware:

    const csrf = require("csurf");
    const csrfProtection = csrf({cookie: true });

    app.get('/', csrfProtection, (req, res) => {
        res.render('index', {title: 'User List', users, errors: [], csrfToken: req.csrfToken() });
    });

    app.post('/users', csrfProtection, checkFields, (req, res) => {
        if (req.errors.length >= 1) {
            res.render('index', { errors: req.errors, users });
            req.errors = [];
            return
        }
        const { username, email, password } = req.body;
        const user = ( un: username, email, password };
        users.push(user);
        res.redirect('/');
    });

In your html, use a hidden input for your csrfToken:

form(method="post" action="users")
  input(type="hidden" name="_csrf" value=csrfToken);
  ...

The built-in express.urlencoded() middleware

    app.use(express.urlencoded({
        extended: true,
    }));

If you look at a typical POST request, it does not come in a JSON form:

    curl --request POST \
        --url https://olrn6x3n19.sse.codesandbox.io/test \
        --header 'content-type: application/json' \
        --data '{
            "json-parsing": "just with Express",
            "no": "body-parser"
}'

However, after parsing the body:

    {"json-parsing":"just with Express","no":"body-parser"}

Data validation is the process of ensuring that the incoming data is correct.

Even though you could add validations on the client side, client-side validations are not as secure and can be circumvented. Take for example the "required" setting on a form input. A savvy user could open up dev tools and set required: false, and pass through the now invalid request. Because client-side validations can be circumvented, it's necessary to implement server-side data validations.

500: Internal Server Error. We likely tried to update a database with invalid data and the database returned an error, causing the 500 error.

By performing server-side validations we are more likely to catch errors and return more accurate returned responses, such as a 400-level response.