Lets Innovate

Log tracing with OpenTelemetry and Jaeger: Code Example

jksnu1@gmail.com (Jitendra Kumar Singh) — Tue, 27 Jan 2026 00:08:00 -0800

Here, I am going to discuss about the Distributed Log Tracing in case of Microservices architecture. I have also recorded an Youtube video. Please go through the below Youtube video to get detailed information.

Problem statement:

Suppose we have 3 services in our E-commerce application like Order, Payment and User service. Now, if user is calling Order service to create an order, then the order service is triggering the Payment service and Payment service is triggering the User service.

Client -> Order service -> Payment Service -> User service

Now, for each request, each of this 3 services is creating some logs. Suppose if some error comes and we need to debug then how can we identify which all logs are created from different microservices for a particular request. There is nothing in the logs by which we can group together the logs of a request

Solution:

This problem can be solved by adding an unique ID for each request in all logs for that request. So, if request 1 is creating 10 logs and each of these 10 logs are having the same unique ID then we can put these 10 logs in a single group based on this unique ID and this group of logs is related to request 1. Similarly each request will generate a separate unique ID in logs for grouping the logs and associate these groups with corresponding requests.

This unique ID is basically termed as Trace ID. This trace ID can be created manually in each request and can be made propagated to each intervening microservices. But, this implementation is not Industry standard. There are few Industry recognized, well tested tool to achieve it.

One of these tools is OpenTelementry. OpenTelemetry generates Trace ID for each request and instrument into each request. It gathers some metrics of each request life span through out each intervening microservices. These metrics are span ID, trace ID, span duration, request flow etc. These metrics are not stored in OpenTelemetry. OpenTelemetry just gathers these information by instrumenting the requests and the export these data to some backend services like Jaeger, ELK stack (Elastic Search, Loadash, Kibana), Grafana etc.

Here, I have implemented the open telemetry in my 3 microservices in Node.js. I am giving here the link of my GitHub repository. The technology stack I have used here are:

Node.js

Microservices

OpenTelemetry

Jaeger

Please go through the above Youtube video and GitHub link to get complete idea.

GitHub repository: https://github.com/jksnu/opentelemetry_poc.git

Create VPC and Subnets in AWS CDK (Python) | Explained Step-by-Step 🚀

jksnu1@gmail.com (Jitendra Kumar Singh) — Wed, 12 Nov 2025 09:40:00 -0800

In this blog, we’ll explore how to create a VPC and subnets using AWS CDK in Python. Whether you’re new to AWS CDK or cloud networking, this post will help you understand how to set up a VPC with public and private subnets, configure CIDR blocks correctly, and understand how AWS handles availability zones.

You can also watch the complete hands-on tutorial on my YouTube channel here:

Understanding the VPC Basics:

A Virtual Private Cloud (VPC) is your private network in AWS. It allows you to control your IP address range, create subnets, and configure route tables and gateways.

When you create a VPC using AWS CDK, you define the following:

CIDR Block (e.g., 10.0.0.0/28)
Subnets (public/private/isolated)
Availability Zones
NAT Gateway (if private subnets need internet access)

Setting Up the VPC Using CDK:

Here’s how you can define your VPC in CDK:

from aws_cdk import (
    # Duration,
    Stack,
    aws_ec2 as ec2,
)
from constructs import Construct
import os

class AwsCdkVpcStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        # The code that defines your stack goes here
        self.vpc = ec2.Vpc(
            self, 
            id=f"{os.getenv('AWS_ENV')}_{os.getenv('VPC_NAME')}",
            vpc_name=os.getenv('VPC_NAME'),
            cidr=os.getenv('CIDR_BLOCK'),
            max_azs=2,
            create_internet_gateway=True,
            nat_gateways=0,    

            subnet_configuration=[
                ec2.SubnetConfiguration(
                    name=f"PublicSubnet_{os.getenv('AWS_ENV')}_{os.getenv('VPC_NAME')}_{self.region}",
                    subnet_type=ec2.SubnetType.PUBLIC,
                    cidr_mask=28,
                    map_public_ip_on_launch=True
                ),
                ec2.SubnetConfiguration(
                    name=f"PrivateSubnet_{os.getenv('AWS_ENV')}_{os.getenv('VPC_NAME')}_{self.region}",
                    subnet_type=ec2.SubnetType.PRIVATE_WITH_EGRESS,
                    cidr_mask=28
                ),
                ec2.SubnetConfiguration(
                    name=f"IsolatedSubnet_{os.getenv('AWS_ENV')}_{os.getenv('VPC_NAME')}_{self.region}",
                    subnet_type=ec2.SubnetType.PRIVATE_ISOLATED,
                    cidr_mask=28
                ),
            ]
        )

Command	Purpose
`cdk synth`	Synthesizes your CDK code into a CloudFormation template
`cdk bootstrap`	Prepares your AWS environment for CDK deployments
`cdk deploy`	Deploys your stack(s) to AWS

GITHUB Link: https://github.com/jksnu/aws_vpc_cdk.git

Learn AWS FREE! | Best Way to Start AWS Cloud Training (Official AWS Ski...

jksnu1@gmail.com (Jitendra Kumar Singh) — Thu, 30 Oct 2025 00:17:00 -0700

Want to start your AWS Cloud journey for FREE? 🌩️
In this video, I’ll show you how you can learn AWS services completely free using the official AWS Skill Builder platform — straight from Amazon Web Services itself!

🎓 What you’ll learn in this video:
✅ How to access AWS Skill Builder
✅ Best free courses to start with (Cloud Practitioner, EC2, S3, Lambda, etc.)
✅ How to get AWS Cloud Practitioner Certified (with no cost!)
✅ Tips to learn faster and track your AWS progress

📚 Start learning now:
👉 https://skillbuilder.aws

💡 Whether you’re a beginner or want to upgrade your cloud skills, this video will help you kickstart your AWS journey without spending a single rupee!

If you found this video helpful, don’t forget to LIKE 👍, SUBSCRIBE 🔔, and SHARE it with your friends who want to learn AWS for free

Build a RAG-Based AI Chatbot with Multi-File Upload and Chroma DB (Vector DB) Integration

jksnu1@gmail.com (Jitendra Kumar Singh) — Sat, 13 Sep 2025 00:46:00 -0700

Retrieval-Augmented Generation (RAG) has become a popular approach in building AI chatbots that provide accurate and context-aware answers. In this tutorial, we will build a RAG-based chatbot where users can upload multiple documents (PDF, Word, etc.) to create a custom knowledge base. When users query, the chatbot will fetch relevant context from these documents using Chroma DB (a vector database) and provide precise answers.

Watch the full step-by-step video tutorial here:
👉 YouTube Video: Build RAG-Based Chatbot with Multi-File Upload + Chroma DB

What is RAG (Retrieval-Augmented Generation)?

RAG combines:

Retrieval → Fetches relevant information from a knowledge base.
Generation → Uses an LLM (Large Language Model) like OpenAI GPT to generate context-aware answers.

This approach ensures:

No hallucinations (random answers).
Context-based responses from your documents.

Architecture Overview:

User uploads documents (PDF, Word, PPT, etc.)
Text extraction → Convert documents into text.
Embeddings creation → Convert text into vector embeddings.
Store embeddings in Chroma DB
Query flow:

Convert user query into an embedding.
Fetch top N relevant chunks from Chroma DB.
Pass context + query to LLM for response.

Tools & Libraries Used:

Python for backend
Chroma DB for vector storage
Hugging Face LLM
Hugging Face Embedding Model
Flask for API

Below are the code snippet for different steps. You can go through my Youtube video to the complete detail and GitHub repository link

Initialize Chroma DB and Create a Collection

import chromadb

client = chromadb.PersistentClient(path="./chroma_db")
collection = client.get_or_create_collection(name="docs")

Generate Embeddings:

import requests
from typing import List
import os
import logging

headers = {
    "Authorization": f"Bearer {os.getenv("HUGGINGFACEHUB_API_TOKEN")}",
    "Content-Type": "application/json"
}

logger = logging.getLogger(__name__)
EMBEDDING_MODEL = os.getenv("EMBEDDING_MODEL", "sentence-transformers/distilbert-base-nli-mean-tokens")    

# Function to get embedding for a given text using Hugging Face API
# This function assumes that the environment variable EMBEDDING_MODEL is set to a valid Hugging Face model ID
# Example: EMBEDDING_MODEL="sentence-transformers/distilbert-base-nli-mean-tokens"

def get_embedding(text: str) -> List[float]:
    try:
        url = f"https://api-inference.huggingface.co/models/{EMBEDDING_MODEL}"
        print(f"url: {url}")
        response = requests.post(url, headers=headers, json={"inputs": text}, timeout=60, verify=False)
        response.raise_for_status()
        embedding = response.json()
        return embedding  # This is a list of floats
    except Exception as e:
        logger.error(f"Error getting embedding: {e}")
        raise ValueError("Failed to get embedding from the model.")

Store embedded data in Chroma DB:

def add_documents_to_vector_store(docs: list[str], ids: list[str], filename: str) -> None:
    try:
        vectors = [get_embedding(text) for text in docs]
        collection.add(
            documents=docs, 
            embeddings=vectors, 
            ids=ids,
            metadatas=[{"filename": filename} for _ in docs]
        )
    except Exception as e:
        logger.error(f"Error adding documents to vector store: {e}")
        raise ValueError(f"Failed to add documents to vector store: {e}")

Query Chroma DB:

def query_similar_documents(query: str, top_k: int = 3) -> list[str]:
    try:
        context_files = get_uploaded_files()
        print(f"Context files available: {context_files}")
        if len(context_files) == 0:
            return []
        query_vector = get_embedding(query)
        results = collection.query(
            query_embeddings=[query_vector], 
            n_results=top_k,
            where={"filename": {"$in": context_files}}
        )
        return results["documents"][0]
    except Exception as e:
        logger.error(f"Error querying similar documents: {e}")
        raise ValueError(f"Failed to query similar documents: {e}")

Combine with LLM for Answer Generation:

import os
import requests
import logging
from typing import List
from sklearn.feature_extraction.text import TfidfVectorizer
from sklearn.metrics.pairwise import cosine_similarity
import re
import chromadb
from chromadb.config import Settings
from app.core.chroma_store import query_similar_documents, add_documents_to_vector_store

from huggingface_hub import InferenceClient

logger = logging.getLogger(__name__)

HUGGINGFACE_API_TOKEN = os.getenv("HUGGINGFACEHUB_API_TOKEN")
LLM_MODEL = os.getenv("LLM_MODEL") #    mistralai/Mixtral-8x7B-Instruct-v0.1

headers = {
    "Authorization": f"Bearer {os.getenv("HUGGINGFACEHUB_API_TOKEN")}",
    "Content-Type": "application/json"
}

def build_client() -> InferenceClient:
    return InferenceClient(
        model=LLM_MODEL,
        token=HUGGINGFACE_API_TOKEN,
        timeout=300
    )

def get_llm_response(prompt: str):
    try:

        client = build_client()
        SYSTEM_PROMPT = """You are a Personal assistant specialized in providing well formated answer from the context being provided."""
        messages = [
            {"role": "system", "content": SYSTEM_PROMPT},
            {"role": "user", "content": f"Provide well formated answer from the given context.\n\n{prompt}"}
        ]
        result = client.chat.completions.create(
            model=LLM_MODEL,
            messages=messages,
            temperature=0.1,
            max_tokens=200
        )
        text = result.choices[0].message.content
        if isinstance(text, list):
            text = "".join(part.get("text", "") if isinstance(part, dict) else str(part) for part in text)
        return text

    except Exception as e:
        logger.error(f"Error getting LLM response: {e}")
        raise ValueError("Failed to get response from the LLM model.")

✅ Full Video Tutorial

📌 Watch the complete step-by-step guide with implementation here:
👉 Build RAG-Based Chatbot with Multi-File Upload + Chroma DB

Deploy AWS Lambda Using AWS CDK in Python (Step-by-Step Guide)

jksnu1@gmail.com (Jitendra Kumar Singh) — Thu, 4 Sep 2025 02:34:00 -0700

If you want to learn how to deploy an AWS Lambda function using the AWS Cloud Development Kit (CDK) in Python, you’ve landed in the right place! In this post, I’ll walk you through the prerequisites, setup, and exact steps you need to follow. I’ll also share some code snippets and give a reference to my YouTube video tutorial for better understanding.

🎥 Watch the complete tutorial on YouTube here: AWS CDK Tutorial in Python | Deploy Lambda from S3

Prerequisites

Before we get started, make sure you have the following ready:

Programming Language Setup – Install Python (preferably 3.10+).
Free-tier AWS Account – Sign up at AWS.
Node.js and NPM Installed – Required for CDK installation.

Steps to Deploy Lambda with AWS CDK

Step 1) Configure AWS CLI: Run below command on CMD and provide your AWS Access Key, Secret Key, Region and output format.

aws configure

Step 2) Install AWS CDK: Run below NPM command to install AWS SDK globally:

npm install -g aws-cdk

Step 3) Verify installation: Run the below command in CMD and if it is giving correct response then installation is complete:

cdk --version

Step 4) Create a New CDK Project: Go to the folder where you want to create your project and run the below command in CMD to create CDK project structure in Python

cdk init app --language python

Step 5) Open Project in VSCode: Navigate into your project directory and open it in Visual Studio Code.

Step 6) Add Lambda Deployment Code: In your Stack file, add the infrastructure code as follows:

from aws_cdk import (
    Duration,
    Stack,
    aws_lambda as _lambda,
    aws_lambda,
    aws_s3 as s3,
    aws_logs as logs,
    RemovalPolicy,
    aws_iam as iam,
    aws_scheduler as scheduler,
    aws_apigateway as apigwv,
    CfnOutput
)
from constructs import Construct
from typing import cast

class Hello_Lambda_CDK_Stack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        bucket_name = "jitendra-lambda-bucket"
        object_key = "mylambda.zip"

        # Define a log group for the Lambda function
        log_group = logs.LogGroup(
            self, f"HelloLambdaFN-LogGroup-ID",
            log_group_name=f"/aws/lambda/HelloLambdaFN-LogGroup",
            removal_policy=RemovalPolicy.DESTROY,
            retention=logs.RetentionDays.THREE_DAYS
        )

        # Define a Lambda function resource here
        my_lambda = _lambda.Function(
            self, f"HelloLambdaFN-ID",
            runtime=_lambda.Runtime.PYTHON_3_13,
            handler="lambda_function.lambda_handler",
            code=_lambda.Code.from_bucket( 
                bucket = s3.Bucket.from_bucket_name(
                    self, f"HelloLambdaFN-Bucket-ID", 
                    bucket_name
                ),
                key = object_key
            ),
            log_group=log_group,
            timeout=Duration.seconds(30),
            memory_size=128,
            function_name="HelloLambdaFN"
        )
        
        # Add permissions for the Lambda function to write to the log group
        log_group.grant_write(my_lambda)

        # Define an API Gateway HTTP API to trigger the Lambda function
        apigatewayobj = apigwv.LambdaRestApi(
            self, "HelloLambdaFN-API-Gateway",
            rest_api_name="HelloLambdaFN-API",
            handler=cast(aws_lambda.IFunction, my_lambda),
            proxy=True
        )   

        CfnOutput(
            self, "APIEndpoint",
            value=apigatewayobj.url,
            description="The endpoint URL of the HelloLambdaFN API Gateway",
        )

Step 7) Bootstrap AWS Environment: This prepares your AWS account to use CDK.

cdk bootstrap

Step 8) Build Your Application (Optional): For Python, explicit build isn’t needed.

Step 9) Synthesize CloudFormation Template: This generates the underlying CloudFormation template and highlight any error if there in your infrastructure code.

cdk synth

Step 10) Deploy the Stack: Run the below command in CMD and it will start creating your AWS infrastructure as per your code in step by step. Before final deployment, it will ask will confirmation and if you confirm then it will start final deployment:

Deploy the Stack

Step 11) Delete the Application: Now, if you want to delete your deployed stack, then you can delete it by running the below CDK command:

cdk destroy

With AWS CDK in Python, deploying a Lambda function directly from an S3 bucket is simple and efficient. By following these steps, you can manage your infrastructure as code and automate serverless deployments.

📺 Don’t forget to watch the complete tutorial video for a practical walkthrough: Click here to watch

Microservices Communication Using Istio | Docker + Minikube Setup on Windows (Hands-on Tutorial)

jksnu1@gmail.com (Jitendra Kumar Singh) — Tue, 22 Apr 2025 06:13:00 -0700

Introduction

In the ever-evolving world of microservices architecture, choosing the right way to enable service-to-service communication is key. Whether you're building an enterprise-scale solution or experimenting with distributed systems, understanding how microservices talk to each other is a must.

In this blog, we will explore the popular ways of microservices communication, understand the power of the Service Mesh pattern with Istio, and finally go hands-on by setting up Istio on Windows using Docker and Minikube.

🎥 Watch Full Tutorial Here:
👉 Microservices Communication Using Istio | Docker + Minikube Setup on Windows (Hands-on Tutorial)

Microservices can communicate in a few different ways:

HTTP REST APIs – Most common and simple.
gRPC – Efficient and high-performance.
Message Queues (Kafka, RabbitMQ) – For asynchronous and decoupled communication.

However, with increasing complexity, managing this communication becomes harder — that’s where Service Mesh comes in.

What is a Service Mesh?

A Service Mesh is a design pattern that provides a dedicated infrastructure layer to manage service-to-service communication. It offers:

Load balancing
Service discovery
Traffic management
Observability
Security (mTLS)
Fault tolerance

All without changing the application code!

Sidecar Proxy & Control Plane:

The service mesh uses the Sidecar Pattern, where each service instance runs alongside a proxy container (usually Envoy).
This proxy handles all the incoming and outgoing traffic, enabling advanced traffic control and telemetry.

The Control Plane (like Istio) configures these proxies and coordinates their behavior across the mesh.

Why Istio?

Istio is one of the most powerful and widely-used service meshes. It simplifies observability, traffic management, and security for microservices. It works seamlessly with Kubernetes and supports features like:

Traffic shaping
Canary deployments
Circuit breakers
Dashboards (Kiali, Jaeger)

Step-by-Step Setup (Windows + Docker + Minikube)

Prerequisites

Install Docker Desktop
Set Environment Path for Docker
Install Minikube (ensure virtualization support is enabled)
Create a DockerHub account

Service Mesh Setup Using Istio

1. Create Microservices

User Service
Order Service
Payment Service

2. Build Docker Images

docker build -t user-service ./user
docker build -t order-service ./order
docker build -t payment-service ./payment

3. Push Images to DockerHub

docker push docker-hub-username/user-service

docker push docker-hub-username/order-service

docker push docker-hub-username/payment-service

4. Start Minikube

minikube start

5. Install istio

istioctl install --set profile=demo -y

6. Inject Istio container as a sidecar proxy in each pod

kubectl label namespace default istio-injection=enabled

7. Run deployment yaml files to create POD replicas

kubectl apply -f user-deployment.yaml

kubectl apply -f order-deployment.yaml

kubectl apply -f payment-deployment.yaml

8. Run Istio yaml file to enable external gateway

kubectl apply -f istio-gateway.yaml

9. Run horizonal pod autoscaling yaml

kubectl apply -f order-hpa.yaml

kubectl apply -f payment-hpa.yaml

kubectl apply -f user-hpa.yaml

10. Run Circuit breaker yaml file

kubectl apply -f payment-cb.yaml

11. Get External IP that is exposed by Istio gateway

minikube tunnel

# In another terminal

kubectl get svc istio-ingressgateway -n istio-system

12. Enable Observability - Optional

istioctl dashboard kiali

istioctl dashboard jaeger

13. Test the User API through postman with below url and input body data

All the code and Yaml files can be found in my below GITHUB link:

GITHUB Repo Link: https://github.com/jksnu/Service-Mesh.git

Setting up a service mesh using Istio may seem overwhelming at first, but once done, it significantly simplifies and strengthens your microservice communication.

If you found this blog helpful, don't forget to subscribe, like, and share the video to help others learn!

👉 Click here to watch the complete hands-on tutorial on YouTube

Master IAM Authentication: Lambda, API Gateway, and Signature V4 in Action

jksnu1@gmail.com (Jitendra Kumar Singh) — Sat, 28 Dec 2024 22:08:00 -0800

Authentication and Authorization two very important pillar of web security. Authentication is basically used to identify the user. It verifies the user is the same user that he is supposed to be. Authorization is used to verify what the user can do. What access he is having.

Here, I am going to discuss about the Authorization. In AWS, authorization can be implemented in 3 ways:

IAM Auth
Lambda authorizer
Token authorizer

In this post, I am discussing mainly about IAM AUTH. You can go through my below Youtube video to get detailed idea.

My Youtube Video Link: https://youtu.be/QKouBNm_-BA

I have created an youtube video on IAM Auth. Here I have shown lambda function creation, API creation, Route Creation, attaching routes with corresponding lambda functions, associating IAM auth with routes, User group creation, User creation, Policy creation and passing signature version 4 token in postman to test authorization of these routes. Below are the steps:

STEPS:

Create two lambda functions for handling two routes
In API Gateway - Create two routes like /helloadmin and /hellouser with GET method
Attach both routes with corresponding lambda functions
Attach each route with IAM auth for authorization
In IAM - Create two groups say Admin and Client
Create two users named as admin_user and client_user under corresponding groups
Create in line policy for both groups

The admin_user should be able to access only /helloadmin NOT /hellouser

The client_user should be able to access only /hellouser NOT /helloadmin

8. Add authorization header in POSTMAN [SignatureV4]

a) Find accesskey, secretkey, sessionToken of both users

b) Pass these values in Authorization tab in POSTMAN

9. After Testing delete all Policies, Users, Groups, IAM APIs, Lambda functions

Please go through the above video where I have showed each steps in detail. It is very informative.

PM2 vs Kubernetes : Do You Really Need Both for Your Node.js App

jksnu1@gmail.com (Jitendra Kumar Singh) — Sun, 3 Nov 2024 01:11:00 -0800

Today, I thought to discuss with you that Do we really need to use PM2 in Node APPLCIATION along with Kubernets. You can also go through the below recorded video on same topic in my Youtube channel:

Video link: https://youtu.be/dcJ5oBCEZ8I?si=vxo0xtqdIjbHz0LY

PM2 provides features like

Process management and monitoring
Automatic restart on failure
Load balancing
Graceful shutdown
Real time metrics and logging

All these features also provided by Kubernets along with many more. So, we can say that kubernetes is a kind of superset of PM2.

Now, it can be said that we can use PM2 in a particular pod for above mentioned feature before interference of kubernets. It's true but isn't it a kind of feature redundancy.

Again, it can be said that PM2 can be used to initiate multiple processes in a pod to perform cpu intensive work. But again here, we can use threadpool mechanism

in node js to handle it.

So, on the whole, I am not able to find a real value of using PM2 in Node JS application along with Kubernets. But yes, in absence of kubernets, PM2 is really very important and light weight process manager. This is my opinion. What's your thought. please mention in the comment box.

Master PM2: Ultimate Guide to Node.js Process Management & Optimization

jksnu1@gmail.com (Jitendra Kumar Singh) — Tue, 1 Oct 2024 03:40:00 -0700

Process Management is a very important aspect in any application configuration. There are several process management libraries. PM2 is one of them that is widely used. Here, I am showing how to use it in Windows system along with its different commands.

IMPORTANT NOTE: You can get full detail in my below Youtube video. Here is the link: https://youtu.be/mwGV0thGBfI?si=mC7hdFg--qmaA-XT

Benefits of Process Management libraries:

Automatic Restart: If your application crashes, PM2 automatically restarts it, ensuring minimal downtime.
Load balancing: PM2 can run your application in cluster mode, leveraging multi-core processors for better performance and scalability.
Process monitoring: It tracks resource consumption (CPU, memory) and provides insights through monitoring tools.
Log Management: PM2 aggregates logs from multiple instances of your application, providing centralized logging and an easy way to debug issues. It also allows you to view real-time logs and can be configured to send logs to external log services.
Performance Optimization: PM2 allows you to run multiple instances of your application (in cluster mode), distributing the load across multiple CPU cores, improving application throughput.
Environment Management: PM2 supports different environments (development, production) and allows you to define different configurations for each environment.
Memory Management: PM2 provides options to set memory limits for your applications. When memory consumption exceeds the limit, it will automatically restart the app, preventing memory leaks from causing issues.
Real-time Monitoring Dashboard: PM2 offers a real-time web dashboard to monitor application status, CPU, memory, and other metrics. This helps in identifying performance bottlenecks or issues in real time.

PM2 Installation: We can use npm command to install PM2 at global mode by using below command:

npm install pm2@latest -g

Start application using PM2: We can use below command to start our node js application named as Test1

pm2 start C:\Personal\Jitendra\workspace\youtube\youtubeCode\app.js --name Test1

Similarly we can another node js application using PM2 on different port like:

pm2 start C:\Personal\Jitendra\workspace\youtube\youtubeCode2\app.js --name Test2

List all applications: We can list down all applications along with their different instances running under PM2.

pm2 list

Monitor application: We can use "pm2 monit" command to open a monitor window to get the real time metrics of the applications running in PM2

Watch logs: We can use below command to get the real time logs of our applications running under pm2

Stop applications: We can use below commands to stop applications running under PM2

pm2 stop Test1 - stops only application named as Test1

pm2 stop all - stops all applications running under PM2

Passing Environment variables: We can pass some secure data to our application at startup time in PM2 through environment variables using below command:

set PORT=3005 && pm2 start C:\Personal\Jitendra\workspace\youtube\youtubeCode\app.js --name Test1

Here, I am passing PORT data as an environment variable at the startup time.

Ecosystem: we can add multiple sub-commands here for different purposes like instance handling, log handling, load balancing and thus the start command will become very complex. So, to solve this problem we can use ecosystem config file. We can automatically generate the file named as "ecosystem.config.js" using command like "pm2 ecosystem" and then we can modify the newly created file as per the application requirement:

module.exports = {
  apps : [{
    name: 'Test2',
    script: './app.js',
    env: {
      NODE_ENV: 'development',
      PORT: 3006
    },
    watch: '.'
  }],

  deploy : {
    production : {
      user : 'SSH_USERNAME',
      host : 'SSH_HOSTMACHINE',
      ref  : 'origin/master',
      repo : 'GIT_REPOSITORY',
      path : 'DESTINATION_PATH',
      'pre-deploy-local': '',
      'post-deploy' : 'npm install && pm2 reload ecosystem.config.js --env production',
      'pre-setup': ''
    }
  }
};

In this file we are passing the port and Node Env as environment variables. Similarly we can pass other variables and config parameters.

To start the application using ecosystem.config.js, we need to use command like "pm2 start ecosystem.config.js"

Similarly, if we want to run another application by using ecosystem.config.js file, then we have to create a separate ecosystem.config.js file and run the command "pm2 start ecosystem.config.js" with respect to this file.

But, what if we have 100 microservices, then we have to create such 100 files for ecosystem.config.js and thus it becomes unmanageable.

To solve this issue, we can create a single ecosystem.config.js file and we can define all the required metrics for each of the microservices in this single file and when we start it through PM2 then all microservices will start. The example of such ecosystem.config.js file is as follows:

module.exports = {
    apps: [
        {
            name: 'Test1',
            script: '../youtube/youtubeCode/app.js',
            instances: 2,
            max_memory_restart: "300M",
            // Logging
            out_file: "./test1.out.log",
            error_file: "./test1.error.log",
            merge_logs: true,
            log_date_format: "DD-MM HH:mm:ss Z",
            log_type: "json",
            watch: true,
            ignore_watch: [
                "../youtube/youtubeCode/node_modules",
                "../youtube/youtubeCode/package.json"
            ],
            // Env Specific Config          
            env: {
                NODE_ENV: 'development',
                PORT: 3005
            }
        },
        {
            name: 'Test2',
            script: '../youtube/youtubeCode2/app.js',
            instances: "1",
            exec_mode: "cluster",
            out_file: "./test2.out.log",
            error_file: "./test2.error.log",
            watch: true,
            ignore_watch: [
                "../youtube/youtubeCode2/node_modules",
                "../youtube/youtubeCode2/package.json"
            ],
            env: {
                NODE_ENV: 'development',
                PORT: 3006
            }
        }
    ],

    deploy: {
        production: {
            user: 'SSH_USERNAME',
            host: 'SSH_HOSTMACHINE',
            ref: 'origin/master',
            repo: 'GIT_REPOSITORY',
            path: 'DESTINATION_PATH',
            'pre-deploy-local': '',
            'post-deploy': 'npm install && pm2 reload ecosystem.config.js --env production',
            'pre-setup': ''
        }
    }
};

Please ping in the comment section if you have any question or suggestion.

Install & configure NGINX on Windows | Steps of NGINX setup on Windows

jksnu1@gmail.com (Jitendra Kumar Singh) — Fri, 14 Jun 2024 07:11:00 -0700

Whenever we search for installation and configuration of NGINX on Windows operating system, we generally find example of Linux or Ubantu machines. So, here I am going to discuss about installation and configuration of NGINX on windows machine. Along with it, I will also discuss about how multiple applications (running on different ports on localhost) can be configured with NGINX.

I have also created an Youtube video about this topic. You can go through the video to get more idea.

NOTE: Link of the video: https://youtu.be/h-NWXxyrkJ0?si=hr-_PZ29B_vbSfkC

STEPS of NGINX Installation:

1) Open the following URL of NGINX download website and download the zip file of latest stable version of NGINX.

URL: https://nginx.org/en/download.html

2) Unzip the file and extract the folder wherever you want to keep your NGINX folder

3) Open CMD in Administration mode and move to the NGINX folder. In my case it is "C:\nginx-1.27.0". Then type command like "start NGINX". Open browser and type "http://localhost:80" and press Enter. Now, if below response is coming on browser then NGINX is running properly.

We can run few more commands of NGINX as per our needs:

Steps of multiple application configuration on NGINX:

Suppose we have two NodeJS application running in our localhost.

localhost:3000/helloworld
localhost:3002/

Here, if we are running these two application on browser, we are getting response. Now, we want to configure both the application in NGINX. After configuring with NGINX, we have to start both the application separately and then restart NGINX server. After this we can access both the application through NGINX in localhost on our Windows machine.

Steps:

1) Open NGINX configuration file that is nginx.conf in Notepad or any editor:

2) Add the following configuration code in http object in nginx.conf file

upstream test_app {
        server 127.0.0.1:3000;
    }

    upstream dev_app {
        server 127.0.0.1:3002;
    }

3) Add the following code in same nginx.conf file under http.server object

location /test/ {
            proxy_pass http://test_app/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        location /dev/ {
            proxy_pass http://dev_app/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

Below, is the complete nginx.conf file.

#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}
    
http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;
    upstream test_app {
        server 127.0.0.1:3000;
    }

    upstream dev_app {
        server 127.0.0.1:3002;
    }
    server {
        listen       80;
        server_name  localhost;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location / {
            root   html;
            index  index.html index.htm;
        }
        
        location /test/ {
            proxy_pass http://test_app/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        location /dev/ {
            proxy_pass http://dev_app/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ \.php$ {
        #    proxy_pass   http://127.0.0.1;
        #}

        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
        #
        #location ~ \.php$ {
        #    root           html;
        #    fastcgi_pass   127.0.0.1:9000;
        #    fastcgi_index  index.php;
        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
        #    include        fastcgi_params;
        #}

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #    deny  all;
        #}
    }


    # another virtual host using mix of IP-, name-, and port-based configuration
    #
    #server {
    #    listen       8000;
    #    listen       somename:8080;
    #    server_name  somename  alias  another.alias;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}


    # HTTPS server
    #
    #server {
    #    listen       443 ssl;
    #    server_name  localhost;

    #    ssl_certificate      cert.pem;
    #    ssl_certificate_key  cert.key;

    #    ssl_session_cache    shared:SSL:1m;
    #    ssl_session_timeout  5m;

    #    ssl_ciphers  HIGH:!aNULL:!MD5;
    #    ssl_prefer_server_ciphers  on;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}

}

4) Test the code changes in nginx.conf file by command "nginx -t" in CMD. If the response of the command is success then its all good otherwise there is some syntax error that should be rectified before starting the NGINX server

5) Restart the NGINX server with command like "nginx -s reload"

6) Now, access both the application in browser with url like

Use URL http://localhost/test instead of localhost:3000/helloworld
Use URL http://localhost/dev instead of localhost:3002/

The Truth About Node.js: Single-Threaded or Multi-Threaded?

jksnu1@gmail.com (Jitendra Kumar Singh) — Tue, 28 May 2024 06:59:00 -0700

Node.js is often described as single-threaded, which can be somewhat misleading. This description primarily refers to the JavaScript execution model. Node.js uses an event-driven, non-blocking I/O model, which allows it to handle many concurrent connections efficiently with a single main thread. However, this doesn't mean that Node.js can't take advantage of multiple threads. Under the hood, Node.js uses a thread pool for certain operations, and with the introduction of worker threads, Node.js can execute JavaScript code in multiple threads.

NOTE: I have described it very clearly in my below Youtube video. The link of the video is https://youtu.be/8IDW3OQ_blQ?si=XCmM3x45nt1FRgj-

Understanding the Single-Threaded Nature

Node.js runs JavaScript code in a single thread. This means that all JavaScript code execution happens in a single call stack, and operations are executed one at a time. This is efficient for I/O-bound tasks, where the main thread can offload tasks like file I/O or network requests to the system's underlying non-blocking capabilities and continue executing other JavaScript code.

Below is the example code where I have created two routes:

const express = require('express');
const app = express();
const port = 3002;

app.get('/nonblocking', (req, res) => {
  res.send("This is non blocking api");
});
app.get('/blocking', (req, res) => {
    for(let i=0; i<99999999999999; i++) {    
    }
   res.send("This is blocking api");
});

app.listen(port, () => {
  console.log(`Server is running on http://localhost:${port}`);
});

Here, the route '/nonblocking' is very simple and light route where I am just returning a string in response and it is taking just few millisecond to return the response. But, in the 2nd route '/blocking', I am traversing a very big loop that is taking several minutes. Now, if any user is calling this route, then the main thread gets blocked in processing this request and it is not available to other request and thus even "/nonblocking" routes are also waiting until the "/blocking" routes gets processed completely. To solve, this issue, I have used worker thread in my below code.

Example of Worker Threads

App.js: Here, I am creating a thread:

const express = require('express');
const app = express();
const port = 3002;

app.get('/nonblocking', (req, res) => {
  res.send("This is non blocking api");
});
app.get('/blocking', (req, res) => {
  const { Worker } = require('worker_threads');
  const worker = new Worker('./worker.js',  {workerData: 999999} );
    worker.on('message', (data) => {
      res.send("This is blocking api with data = "+data);
    });
    worker.on('error', (error) => {
      console.log(error);
    });
    worker.on('exit', (code) => {
      if (code !== 0)
        reject(new Error(`Worker stopped with exit code ${code}`));
    })  
});

app.listen(port, () => {
  console.log(`Server is running on http://localhost:${port}`);
});

Here, the line const worker = new Worker('./worker.js', {workerData: 999999} );

is basically creating a new thread. This thread is emitting events like message, error and exit. We should listen these event to process the data accordingly.

worker.js : Here, we are basically, defining the logic of the task that this thread must perform and once task is completed then it will publish the resultant data by parentPort.postMessage(data);

const { parentPort, workerData } = require('worker_threads');

function countTo(number) {
    let count=0;
    for(let i=0; i<number; i++) { 
        count = count + i;
    }
    return count;
}

const result = countTo(workerData);

parentPort.postMessage(result);

Pros and Cons of Using Worker Threads Pros:

Improved Performance for CPU-bound Tasks: Worker threads can significantly improve the performance of CPU-bound tasks by offloading them to separate threads.
Parallel Execution: Allows for true parallel execution of JavaScript code, which can lead to more efficient use of multi-core processors.
Enhanced Application Responsiveness: By handling heavy computations in worker threads, the main thread remains responsive to I/O operations and user interactions.

Cons:

Complexity: Introducing multi-threading can add complexity to the codebase, making it harder to understand and maintain.
Shared Memory Concerns: While worker threads can share memory using SharedArrayBuffer, managing shared memory can be tricky and prone to errors.
Overhead: Creating and managing worker threads introduces some overhead, which might not be justified for small or simple tasks.

When to Use Worker Threads in Node.js

Worker threads are particularly useful in the following scenarios:

CPU-bound Tasks: Any task that requires significant CPU time, such as complex calculations, image processing, or data parsing, can benefit from being executed in worker threads.
Parallel Processing: Tasks that can be divided into smaller, independent sub-tasks and executed in parallel will see performance gains.
Offloading Intensive Tasks: Tasks that could block the event loop, such as large file processing, can be offloaded to worker threads to keep the main thread responsive.
Real-time Applications: Applications that require real-time processing and cannot afford to have the main thread blocked will benefit from using worker threads.

Conclusion

Node.js is fundamentally single-threaded for JavaScript execution, but it can utilize multiple threads for certain operations and with the introduction of worker threads. This dual capability allows developers to handle both I/O-bound and CPU-bound tasks efficiently. By understanding when and how to use worker threads, developers can optimize their Node.js applications for better performance and responsiveness.

Deploying Your Node.js App on EC2 (Amazon Web Services) with PM2 and NGINX

jksnu1@gmail.com (Jitendra Kumar Singh) — Sun, 26 May 2024 04:04:00 -0700

In this blog, I am going to discuss about how to deploy your Node JS and Express application in AWS EC2 instance. Along with deploying the application I am also setting up the NGINX server and PM2 (Process Manager) library. I have shown all these steps clearly in this Youtube video. Please go through the video to get the complete and clear idea.

NOTE: The URL of this video: https://youtu.be/z0GkpPYwl8o

Steps:

1) Create your free trial AWS login

2) Commit your code to GitHub

3) Create EC2 instance:

Create an EC2 instance. Basically t2-micro ubuntu
Connect to your EC2 instance
Trigger sudo apt update to install any update if available

4) Install node js version 18:

sudo apt install nodejs
node -v
npm -v

5) Verify if GIT and clone your project :

git --version
git clone YOUR_PROJECT_REPOSITORY_URL

6) Project configuration:

Go inside your project folder: cd youtubeCode
Trigger command "npm install" to create the node_module folder
Verify node_module folder by command "ls"

7) Install Process Manager(PM2) library at global level

sudo npm install -g pm2
Then go to your project folder
pm2 start app.js
pm2 logs
pm2 reload all

8) Now you can visit your api in browser: http://IP:Port/routeName

9) Install nginx and configure:

sudo apt install nginx
sudo vim etc/nginx/sites-available/default andthen add below configs in this default file

server_name 54.206.158.160;
location / {
proxy_pass http://localhost:3001;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}

Press ctrl+c and type :wq! to write and quit
Check NGINX config by command "sudo nginx -t". If it is returning success that means your NGINX server is configured properly and you can run your application on your NGINX server.

10) Start your NGINX server: sudo systemctl stop nginx

11) If any changes are being done in NGINX configuration, then you have to restart your NGINX server by command like sudo systemctl start nginx

12) If all steps are being followed properly, then till here, your application will be deployed and running successfully on NGINX server using PM2 library on AWS EC2 instance and now you can access your API just by using your EC2 instance's public IP address. No need to provide the port number. By default NGINX is running on PORT 80 and security group of EC2 instance in AWS is already having inbound rule to allow the traffic from 80 port.

Create AWS RDS DB | Connect localhost with RDS DB

jksnu1@gmail.com (Jitendra Kumar Singh) — Sun, 26 May 2024 03:27:00 -0700

Here, I am trying to create a database in RDS in AWS (Amazon Web Services). Below are the steps that should be followed:

Create a free account in AWS
Go to RDS and create a DB as shown in below video
Utilize the DB URL in API to create database connection.

NOTE: I have described all the steps in my Youtube video. You can follow it on Youtube for better understanding. The URL of this video: https://youtu.be/fj3gCZ9bTOo

Below is the code where I am creating a connection with AWS RDS DB in the file model/index.js. This index.js file is being used in schema file model/user.js. This schema file is being used in service/user.js.

model/index.js - Here, I am establishing connection with AWS RDS DB.

const { Sequelize, DataTypes } = require('sequelize');

// Initialize Sequelize connection
const sequelize = new Sequelize('testdb', 'username', 'password', {
    host: 'testdb.sdjkweurowdsj.ap-southeast-2.rds.amazonaws.com', //It is Dummy hostname
    dialect: 'mysql', // Specify the dialect (in this case, MySQL)
    operationsAliases: false,
    pool: {
      max: 5,
      min: 0,
      acquire: 30000,
      idle: 10000
    }
});

const db = {};
db.sequelize = sequelize;
db.models = {};
db.models.User = require('./user')(sequelize, Sequelize.DataTypes);
module.exports = db;

// Close Sequelize connection when the Node.js process exits
process.on('exit', () => {
    sequelize.close()
      .then(() => {
        console.log('Sequelize connection closed');
      })
      .catch((error) => {
        console.error('Error closing Sequelize connection:', error);
      });
  });
  
  // Handle Ctrl+C or SIGINT signal to gracefully close the connection
  process.on('SIGINT', () => {
    sequelize.close()
      .then(() => {
        console.log('Sequelize connection closed');
        process.exit(0);
      })
      .catch((error) => {
        console.error('Error closing Sequelize connection:', error);
        process.exit(1);
      });
  });
  
  // Handle uncaught exceptions and promise rejections
  process.on('uncaughtException', (error) => {
    console.log(error);
    sequelize.close()
      .then(() => {
        console.log('Sequelize connection closed');
        process.exit(1);
      })
      .catch((closeError) => {
        console.error('Error closing Sequelize connection:', closeError);
        process.exit(1);
      });
  });
  
  process.on('unhandledRejection', (reason, promise) => {
    sequelize.close()
      .then(() => {
        console.log('Sequelize connection closed');
        process.exit(1);
      })
      .catch((closeError) => {
        console.error('Error closing Sequelize connection:', closeError);
        process.exit(1);
      });
  });
  
  

Sequelize Schema file : model/user.js

module.exports = (sequelize, DataTypes) => {
  const UserModel = sequelize.define('User', {
    id: {
      type: DataTypes.INTEGER,
      primaryKey: true,
      autoIncrement: true
    },
    name: {
      type: DataTypes.STRING,
      allowNull: false
    },
    email: {
      type: DataTypes.STRING,
      allowNull: false
    }
  }, {
    tableName: 'users',
    timestamps: false // If your table doesn't have timestamp fields (createdAt, updatedAt)
  });
  return UserModel;
}

Service file: service/user.js

const {models: {User}} = require('../model');
const getUsers = async function () {
  try {
    const users = await User.findAll();
    return users;
  } catch (error) {
    throw error;
  }
}
const addUsers = async function (userObj) {
  try {
    const insertResult = await User.create(userObj);
    return insertResult;
  } catch (error) {
    throw error;
  }
}
const deleteUser = async function (id) {
  try {
    const deleteResult = await User.destroy({"where": {"id": id}});
    return deleteResult;
  } catch (error) {
    throw error;
  }
}
module.exports = {
  getUsers, addUsers, deleteUser
}

Create your chat bot in 10 min by using CHATGPT

jksnu1@gmail.com (Jitendra Kumar Singh) — Sun, 26 May 2024 02:49:00 -0700

I am going to show here how easily we can develop our chatbot with in few minutes using ChatGPT API. Here, I am using followings:

ReactJs for creating user front end
NodeJs for server api interacting with ChatGPT API
ChatGPT API

NOTE: I have described all the steps in my Youtube video also. You can follow it on Youtube for better understanding. The URL of this video: https://youtu.be/zbZfoT3eXmM

Here, we have to complete 3 tasks:

Task 1: Create your ChatGPT API secret key to be used in your code. You need to follow below steps:

Open the url https://openai.com/ and login here using your Google Id or create your own login Id and password.
Create your ChatGPT secret key by clicking on the "Create new Secret key" in the url given in below screenshot. Copy and paste this key in your notepad file. You will not be able to retrieve it again.

Task2: Create Node Js api: Here, we should follow the below steps:

Install NodeJs and NPM
Create a node js project by command npm init -y
Install express and axios dependencies.

{

  "name": "chatnode",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "Jitendra Kumar Singh",
  "license": "ISC",
  "dependencies": {
    "axios": "^1.4.0",
    "express": "^4.18.2"
  }
}

4. Create a new file server.js file where you will define port, start server and create api for interacting with ChatGPT api

const express = require('express');
const axios = require('axios');

const app = express();
const port = 3001; // Set your desired port number

app.use(function (req, res, next) {
  res.header("Access-Control-Allow-origin", "http://localhost:3000")
  res.setHeader('Access-Control-Allow-Methods', "GET,POST,OPTIONS")
  res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept")
  next();
})

// Middleware to parse JSON request bodies
app.use(express.json());

// POST endpoint to handle user queries
app.post('/api/query', async (req, res) => {
  const { query } = req.body;

  try {
    // Make a POST request to the ChatGPT API
    const response = await axios.post('https://api.openai.com/v1/chat/completions', {
      model: 'gpt-3.5-turbo',
      messages: [{ role: 'system', content: 'You are a helpful assistant.' }, { role: 'user', content: query }],
    }, {
      headers: {
        'Authorization': 'Bearer YOUR_CHATGPT_API_SECRET_KEY', // Replace with your ChatGPT API key
        'Content-Type': 'application/json',
      },
    });

    res.json({ reply: response.data.choices[0].message.content });
  } catch (error) {
    console.error('Error:', error.response.data);
    res.status(500).json({ error: 'An error occurred while processing the request.' });
  }
});

// Start the server
app.listen(port, () => {
  console.log(`Server is running on http://localhost:${port}`);
});

5) Start your node js server by npm start

Task 3: Create ReactJS user interface: Here, we need to follow below steps:

In another separate directory, create ReactJs project by using command npx create-react-app your_project_name
Once installation is done, then create dependency of axios. Your final package.json file would be like

{
  "name": "client",
  "version": "0.1.0",
  "private": true,
  "dependencies": {
    "@testing-library/jest-dom": "^5.16.5",
    "@testing-library/react": "^13.4.0",
    "@testing-library/user-event": "^13.5.0",
    "axios": "^1.4.0",
    "concurrently": "^8.2.0",
    "react": "^18.2.0",
    "react-dom": "^18.2.0",
    "react-scripts": "5.0.1",
    "web-vitals": "^2.1.4"
  },
  "scripts": {
    "start": "react-scripts start",
    "build": "react-scripts build",
    "test": "react-scripts test",
    "eject": "react-scripts eject"
  },
  "eslintConfig": {
    "extends": [
      "react-app",
      "react-app/jest"
    ]
  },
  "browserslist": {
    "production": [
      ">0.2%",
      "not dead",
      "not op_mini all"
    ],
    "development": [
      "last 1 chrome version",
      "last 1 firefox version",
      "last 1 safari version"
    ]
  }
}

3) Then open App.js file inside folder named as src and add below code

import React, { useState } from 'react';
import axios from 'axios';

const App = () => {
  const [query, setQuery] = useState('');
  const [reply, setReply] = useState('');

  const handleSubmit = async (event) => {
    event.preventDefault();

    try {
      const response = await axios.post('http://localhost:3001/api/query', { query });

      setReply(response.data.reply);
    } catch (error) {
      console.error('Error:', error.response.data);
    }
  };

  return (
    <div>
      <h1>My Chatbot</h1>
      <form onSubmit={handleSubmit}>
        <input type="text" value={query} onChange={(e) => setQuery(e.target.value)} />
        <button type="submit">Send</button>
      </form>
      {reply && <p>{reply}</p>}
    </div>
  );
};

export default App;

4) Start your UI react application by using command npm start

So, finally when you start UI and Node Js server then you will get functionality as shown below:

Sequelize in Node.js Application | Sequelize in Express Application | Establishing Database Connections in Node.js

jksnu1@gmail.com (Jitendra Kumar Singh) — Thu, 29 Feb 2024 00:52:00 -0800

Today, I am going to discuss establishing a database connection in Node.js. I have already installed MySQL Server 8.0 on my local machine. I will use an ORM (Object Relational Mapping) framework named Sequelize to connect with the database in my Node.js and Express application.

Note: I have created a video tutorial about the same topic. Below is the link of the video tutorial.

Video tutorial of Sequelize DB connection in Node.js Application

Below are the steps to establish the database connection and interact with it.

Step1> Install Sequelize and mysql2 driver npm packages in your application.

{
  "name": "helloworld",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "",
  "license": "ISC",
  "dependencies": {
    "express": "^4.18.2",
    "morgan": "^1.10.0",
    "mysql2": "^3.9.2",
    "sequelize": "^6.37.1"
  }
}

Step2> Create a file named as index.js in a folder named as model in your application. In this index.js file, add DB config and create an object of Sequelize. Afterwards, you need to pass this sequelize object in all your model files definition. Model files are nothing but the replicas of a particular table. Below is the code for creating connection between Sequelize and MySql DB. Here, my dbName=testdb, username=root and password=admin. As I have installed MySql in my local machine, so, hostname=localhost otherwise it would be IP address or path of your remote server having the DB.

const { Sequelize, DataTypes } = require('sequelize');

// Initialize Sequelize connection
const sequelize = new Sequelize('testdb', 'root', 'admin', {
    host: 'localhost',
    dialect: 'mysql', // Specify the dialect (in this case, MySQL)
    operationsAliases: false,
    pool: {
      max: 5,
      min: 0,
      acquire: 30000,
      idle: 10000
    }
});

const db = {};
db.sequelize = sequelize;
db.models = {};
db.models.User = require('./user')(sequelize, Sequelize.DataTypes);
module.exports = db;

// Close Sequelize connection when the Node.js process exits
process.on('exit', () => {
    sequelize.close()
      .then(() => {
        console.log('Sequelize connection closed');
      })
      .catch((error) => {
        console.error('Error closing Sequelize connection:', error);
      });
  });
  
  // Handle Ctrl+C or SIGINT signal to gracefully close the connection
  process.on('SIGINT', () => {
    sequelize.close()
      .then(() => {
        console.log('Sequelize connection closed');
        process.exit(0);
      })
      .catch((error) => {
        console.error('Error closing Sequelize connection:', error);
        process.exit(1);
      });
  });
  
  // Handle uncaught exceptions and promise rejections
  process.on('uncaughtException', (error) => {
    console.log(error);
    sequelize.close()
      .then(() => {
        console.log('Sequelize connection closed');
        process.exit(1);
      })
      .catch((closeError) => {
        console.error('Error closing Sequelize connection:', closeError);
        process.exit(1);
      });
  });
  
  process.on('unhandledRejection', (reason, promise) => {
    sequelize.close()
      .then(() => {
        console.log('Sequelize connection closed');
        process.exit(1);
      })
      .catch((closeError) => {
        console.error('Error closing Sequelize connection:', closeError);
        process.exit(1);
      });
  });
  
  

If you go through the above code, I have written few blocks of code to gracefully close the DB connection if the process is failing due to any reasons like process.exit or SIGINT signal or Unhandled exception or Unhandled rejections.

Step 3> Now, We should create a model file. As discussed, model is nothing but the replica of a table in your DB. I have created here a model named as User corresponding to the table Users. Here, model name and table name may be same. If these are not same then we have to specify the table name by attribute tableName: 'users'. While defining this model, I am using the sequelize object being passed from index.js file where we have created the DB connection with Sequelize.

module.exports = (sequelize, DataTypes) => {
  const UserModel = sequelize.define('User', {
    id: {
      type: DataTypes.INTEGER,
      primaryKey: true,
      autoIncrement: true
    },
    name: {
      type: DataTypes.STRING,
      allowNull: false
    },
    email: {
      type: DataTypes.STRING,
      allowNull: false
    }
  }, {
    tableName: 'users',
    timestamps: false 
  });
  return UserModel;
}

Step 4> Next, we will utilize this model file in our service class to perform CRUD operations on users table. Here, I have created functions to get list of users, add new user and delete an user.

const {models: {User}} = require('../model');
const getUsers = async function () {
  try {
    const users = await User.findAll();
    return users;
  } catch (error) {
    throw error;
  }
}
const addUsers = async function (userObj) {
  try {
    const insertResult = await User.create(userObj);
    return insertResult;
  } catch (error) {
    throw error;
  }
}
const deleteUser = async function (id) {
  try {
    const deleteResult = await User.destroy({"where": {"id": id}});
    return deleteResult;
  } catch (error) {
    throw error;
  }
}
module.exports = {
  getUsers, addUsers, deleteUser
}

Step 5> Next, we will create a controller class where we will use service functions to interact with DB. The controller functions will be used as middleware in route file.

const userService = require('../service/user');
const getUsers = async (req, res, next) => {
    try {
        const users = await userService.getUsers();
        res["result"] = users;
        next();
    } catch (error) {
        throw error;
    }
};
const addUsers = async (req, res, next) => {
    try {
        const userObj = {
            "name": req.body.name,
            "email": req.body.email
        };
        const insertResult = await userService.addUsers(userObj);
        res["result"] = insertResult;
        next();
    } catch (error) {
        throw error;
    }
};
const deleteUser = async (req, res, next) => {
    try {        
        const deleteResult = await userService.deleteUser(req.query.id);
        res["result"] = deleteResult;
        next();
    } catch (error) {
        throw error;
    }
};
module.exports = {
    getUsers, addUsers, deleteUser
}

Step 6> Create a route file and call the controller middleware functions in each routes.

const express = require('express');
const router = express.Router();
const userCtrl = require('../controller/user');
const { routeMiddleware } = require('../myMiddleware/customMiddleware'); 

router.get('/helloWorld', (req, res) => {
  res.send('Hello, World!');
});

router.delete('/deleteuser', userCtrl.deleteUser, (req, res) => {
  const { name, email } = req.query;
  res.json({"status": "success", "result": res.result});
});

router.get('/users', userCtrl.getUsers, (req, res) => {
  res.json({"status": "success", "result": res.result});
});

router.post('/adduser', userCtrl.addUsers, (req, res) => {
  const { name, email } = req.body;
  res.json({"status": "success", "result": res.result});
});

module.exports = router;

Step 7> One most important step that we need to do here is to trigger sync() function of Sequelize in your app.js file (where you are initializing your server) to get all your defined models synced with DB.

const express = require('express');
const bodyParser = require('body-parser');
const morgan = require('morgan');
const db = require('./model');
const { errorHandler, applicationMiddleware } = require('./myMiddleware/customMiddleware');
const routes = require('./route/routes');

const app = express();
const port = 3000;

(async () => {
  await db.sequelize.sync();
})();

// Built-in Middleware to parse JSON data in the request body
app.use(bodyParser.json());

//Using Third-party middleware function for logging
app.use(morgan('dev'));

// Application level middleware
app.use(applicationMiddleware);

// Use the routes in your app
app.use('/', routes);

//Using error handler middleware
app.use(errorHandler);

app.listen(port, () => {
  console.log(`Server is running on http://localhost:${port}`);
});

I have created a video tutorial about the same topic. Below is the link of the video tutorial.

Video tutorial of Sequelize DB connection in Node.js Application

Create your ChatBot using NodeJs and ReactJs with ChatGPT API in 10 minutes

jksnu1@gmail.com (Jitendra Kumar Singh) — Sun, 11 Jun 2023 08:59:00 -0700

Today, I am going to show here how easily we can develop our chatbot with in few minutes using ChatGPT api. Here, I am using followings:

I have described all the steps in my Youtube video also. You can follow it on Youtube for better understanding. The URL of this video: https://youtu.be/zbZfoT3eXmM

ReactJs for creating user front end
NodeJs for server api interacting with ChatGPT API
ChatGPT API

Here, we have to complete 3 tasks:

Task 1: Create your ChatGPT API secret key to be used in your code. You need to follow below steps:

Open the url https://openai.com/ and login here using your Google Id or create your own login Id and password.
Create your ChatGPT secret key by clicking on the "Create new Secret key" in the url given in below screenshot. Copy and paste this key in your notepad file. You will not be able to retrieve it again.

Task2: Create Node Js api: Here, we should follow the below steps:

Install NodeJs and NPM
Create a node js project by command npm init -y
Install express and axios dependencies.

{

  "name": "chatnode",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "Jitendra Kumar Singh",
  "license": "ISC",
  "dependencies": {
    "axios": "^1.4.0",
    "express": "^4.18.2"
  }
}

4. Create a new file server.js file where you will define port, start server and create api for interacting with ChatGPT api

const express = require('express');
const axios = require('axios');

const app = express();
const port = 3001; // Set your desired port number

app.use(function (req, res, next) {
  res.header("Access-Control-Allow-origin", "http://localhost:3000")
  res.setHeader('Access-Control-Allow-Methods', "GET,POST,OPTIONS")
  res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept")
  next();
})

// Middleware to parse JSON request bodies
app.use(express.json());

// POST endpoint to handle user queries
app.post('/api/query', async (req, res) => {
  const { query } = req.body;

  try {
    // Make a POST request to the ChatGPT API
    const response = await axios.post('https://api.openai.com/v1/chat/completions', {
      model: 'gpt-3.5-turbo',
      messages: [{ role: 'system', content: 'You are a helpful assistant.' }, { role: 'user', content: query }],
    }, {
      headers: {
        'Authorization': 'Bearer YOUR_CHATGPT_API_SECRET_KEY', // Replace with your ChatGPT API key
        'Content-Type': 'application/json',
      },
    });

    res.json({ reply: response.data.choices[0].message.content });
  } catch (error) {
    console.error('Error:', error.response.data);
    res.status(500).json({ error: 'An error occurred while processing the request.' });
  }
});

// Start the server
app.listen(port, () => {
  console.log(`Server is running on http://localhost:${port}`);
});

5) Start your node js server by npm start

Task 3: Create ReactJS user interface: Here, we need to follow below steps:

In another separate directory, create ReactJs project by using command npx create-react-app your_project_name
Once installation is done, then create dependency of axios. Your final package.json file would be like

{
  "name": "client",
  "version": "0.1.0",
  "private": true,
  "dependencies": {
    "@testing-library/jest-dom": "^5.16.5",
    "@testing-library/react": "^13.4.0",
    "@testing-library/user-event": "^13.5.0",
    "axios": "^1.4.0",
    "concurrently": "^8.2.0",
    "react": "^18.2.0",
    "react-dom": "^18.2.0",
    "react-scripts": "5.0.1",
    "web-vitals": "^2.1.4"
  },
  "scripts": {
    "start": "react-scripts start",
    "build": "react-scripts build",
    "test": "react-scripts test",
    "eject": "react-scripts eject"
  },
  "eslintConfig": {
    "extends": [
      "react-app",
      "react-app/jest"
    ]
  },
  "browserslist": {
    "production": [
      ">0.2%",
      "not dead",
      "not op_mini all"
    ],
    "development": [
      "last 1 chrome version",
      "last 1 firefox version",
      "last 1 safari version"
    ]
  }
}

3) Then open App.js file inside folder named as src and add below code

import React, { useState } from 'react';
import axios from 'axios';

const App = () => {
  const [query, setQuery] = useState('');
  const [reply, setReply] = useState('');

  const handleSubmit = async (event) => {
    event.preventDefault();

    try {
      const response = await axios.post('http://localhost:3001/api/query', { query });

      setReply(response.data.reply);
    } catch (error) {
      console.error('Error:', error.response.data);
    }
  };

  return (
    <div>
      <h1>My Chatbot</h1>
      <form onSubmit={handleSubmit}>
        <input type="text" value={query} onChange={(e) => setQuery(e.target.value)} />
        <button type="submit">Send</button>
      </form>
      {reply && <p>{reply}</p>}
    </div>
  );
};

export default App;

4) Start your UI react application by using command npm start

So, finally when you start UI and Node Js server then you will get functionality as shown below:

Assume AWS role and retrieve temporary credentials to access allowed services of AWS

jksnu1@gmail.com (Jitendra Kumar Singh) — Sat, 13 Aug 2022 00:06:00 -0700

Scenario:

Suppose I am an user of an AWS account with account id 1111 and I want to programmatically access a S3 bucket created in another AWS account 2222. So, how can I access it programmatically through cross account. To fulfill this scenario, we have to follow the following steps:

Steps:

Admin of account 2222 should create a bucket say Bucket2222.
Admin of account 2222 should create an IAM Role with minimum 2 policies. One will be the Trust Policy and second with the list of accesses of the Bucket2222
Admin of account 1111 should give me the IAM access of Assume Role
In Node JS code, I have to first get the temporary credential of the IAM Role created in Account 2222 by using aws-sdk version 3 STSClient class
If needed I can cache the credential in API side to reuse it until it is expired
I will access the Bucket2222 in Account 2222 by using S3Client class of aws-sdk version 3 by passing the temporary credentials

Below is the complete code to access the temporary credential of this role and then listing the bucket items:

Package.json

{
  "name": "aws_node_poc",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "Jitendra Kumar Singh",
  "license": "ISC",
  "dependencies": {
    "@aws-sdk/client-s3": "^3.142.0",
    "@aws-sdk/client-sts": "^3.142.0"
  }
}

Constants.js

module.exports = {
    "REGION": "My Region name",
    "ASSUME_ROLE_ARN": "arn:aws:iam::2222:role/my_assume_role_name",
    "TEST_BUCKET_NAME": "Bucket2222"
}

AssumeRoleAndAccessBucket.js

 const { S3Client, ListObjectsCommand } = require("@aws-sdk/client-s3"); 
 const { STSClient, AssumeRoleCommand, GetCallerIdentityCommand } = require("@aws-sdk/client-sts");
 const { REGION, ASSUME_ROLE_ARN, TEST_BUCKET_NAME } = require('../../util/constants.js');

 //Getting Role credentials
 const assumeRole = async () => {
    try {
        let rolecreds;
        /**
         * The credential can be cached on api side in reddish or memcache
         * to reuse the credential till it is expired. This credential is having Expiration 
         * attribute that defines the time when it is expired
         * We can check this time to verify whether temp credential is expired
         * If not then reuse it and if expired then send a hit to AWS to get new temp credential
         */
        //rolecreds = "Get credential from API cache if cached and if not expired"

        if(!rolecreds) {
            // Create an Amazon STS service client object.
            const stsClient  = new STSClient({
                region: REGION
            });

            // Set the parameters
            const params = {
                RoleArn: ASSUME_ROLE_ARN, //ARN_OF_ROLE_TO_ASSUME
                RoleSessionName: "MyAssueRoleSessionName",
                DurationSeconds: 3600,
            };

            //Assume Role
            const data = await stsClient.send(new AssumeRoleCommand(params));
            console.log("Cred = ", data);
            
            rolecreds = {
                accessKeyId: data.Credentials.AccessKeyId,
                secretAccessKey: data.Credentials.SecretAccessKey,
                sessionToken: data.Credentials.SessionToken
            };
        }        

        /*const stsParams = { credentials: rolecreds };
        const stsClient1 = new STSClient(stsParams);
        const results = await stsClient1.send(
            new GetCallerIdentityCommand(rolecreds)
        );*/

        return rolecreds;
    } catch (error) {
        throw error;   
    }    
 }

 //Getting Object List from Bucket
 const listObjects = async(roleCred) => {
    try {
        //Creating S3 Client
        const s3Client = new S3Client({ 
            region: REGION,
            credentials: roleCred
        });
        //Getting object list from bucket
        const bucketParams = { Bucket: TEST_BUCKET_NAME };
        const data = await s3Client.send(new ListObjectsCommand(bucketParams));
        return data;
    } catch (error) {
        throw error;
    }
 }

 //Getting Role credential and calling function to get object list from bucket
 const listBucketObjects = async() => {
    try {
        const roleCred = await assumeRole();
        //get object list of the bucket
        const result = await listObjects(roleCred);
        return result;
    } catch (error) {
        throw error;
    }    
 }

 //Triggering function to initiate process of getting data from bucket by using Role
 listBucketObjects()
 .then(data => {
    console.log(data);
 }).catch(err => {
    console.log("Error in my code = ", err);
 })
 

This is all I am having here to deal with such scenarios. Please let me know in comment section if you facing any problem in any other scenarios, I will try to post blog related with those issues.

NFR : None Functional Requirement in Software Engineering or Application Development : Part 4: Extensibility, Observability, Maintainability

jksnu1@gmail.com (Jitendra Kumar Singh) — Sun, 17 Jul 2022 08:45:00 -0700

In this post, we are going to discuss about the remaining 3 NFRs like Extensibility, Observability, Maintainability. The link of all of my posts related with NFR are as follows:

Links:

Extensibility: Extensibility is a measure of the ability to extend an application and the level of effort required to implement the extension. It's components are like:

Flexibility: It defines how flexible your application is towards accepting business growing needs and new functionality changes. We can make our application more flexible by applying OOPS concepts, Dependence Injection, Applying Microservice/ Microviews architecture etc.
Configurability: It measures the extent of configuration used in your application. We should be able to add or hide the functionality from an application by configuration. There should not be any code related with any 3rd party application or vendor. It should be in config files. So that, we can replace the 3rd party application by changing in config files and very minimal change in code. This way it will require less testing and application will be ready very quickly with less effort and minimum impact.
Customizability: It is very closely related with configurability. If application is highly configurable then it will be highly customizable. The vendor or client specific functionality in your application should be in plug-in-play mode.
Upgradeability: It defines how easily your application's different components can be upgraded. Generally, we should use the built-in features of the technologies in our application so that we can upgrade our technology and all the built-in features will be upgraded automatically and easily. If we are using any 3rd party vendor's feature its difficult to upgrade as the upgraded feature may not support our application's underlying technology.
Integrity: The application should be well integrated with other required business system. For example, your application should be integrated with analytic tool, dataware house etc. It should be capable to sharing the correct reports in terms of csv or excel with other business system. It should be easily integrated with any new incoming business component or vertical by applying some configuration changes and minimal code changes.

Observability: Observability is all about data exposure and easy access to information required to find issues when the communications fail, internal events do not occur as expected or events occur when they shouldn’t. The observability of your application can be enhanced by proper logging and error handling at every decision point or at the point of communication between different APIs and 3rd party API. We can create some Dashboard to display different metrics of our application. For these purpose, we can use tools like Grafana, Dyanatrace etc. We should also enable dashboard to visualize the logs like Kibana. In case of AWS, we can CloudWatch, Flowlogs for these purpose.

Maintainability: It refers the ease with which we can understand, repair and improve the code of our application. The more maintainable our application is the more easily we can fix bugs, enhance our application's functionalities and fixing the security issues. While performing maintenance activities we can make 4 types of changes to our application:

Corrective: It is related with fixing the bugs and issues in our application. Application code should be well segregated in different files and folders according to its purpose so that required code fixes can be applied easily at the required place.
Adaptive: Our application should be developed in such a way that it can easily accept new functionalities. If needed we can easily removed the deprecated or unwanted functionalities. It should be able to accept the updated libraries, DB, operating system etc.
Perfective: This functionality includes the code changes to improve the application performance.
Preventive: It is associated the required changes in application for enhancing security. Upgrading security is an ongoing and never end work. So, our application should always be ready to accept such security related changes.

NFR : None Functional Requirement in Software Engineering or Application Development : Part 3: Application Security

jksnu1@gmail.com (Jitendra Kumar Singh) — Sun, 17 Jul 2022 00:27:00 -0700

In my previous posts, I have discussed about NFR definition, its requirement and 3 important NFRs like Scalability, Performance and Testability. Below are the links of all of my posts related with NFR:

Links:

Today, I am going to discuss about a very important NFR that is Application Security. Application security is an ongoing and never ending work. Every day, new security threats comes in cyber space and we along with Business team will have to keep eye open on these security threats and if it is going to impact our application, we should take preventive measures as soon as possible. Generally, application security is the responsibility of not only the Development team but it depends on all the participants of the application like:

Business team
Development team
End users
Hosting environment provider
Network provider

Guidelines and conventions has been provided for each participants over internet and if every participants follows performs their roles very cautiously then only we can achieve the application security goal. Normally, it has been found that most of the application security issues comes either due to security loop holes present in application development side or from the End user side. The security issues from End user side can be minimized by increasing the awareness about secure use of the application among End users. This is completely separate set of efforts that application owner's Customer facing team should put to make their customer aware about secure use of application as much as possible. Here, I am not concentrating about customer awareness(although it is backbone of any application security). Here, I will discuss about the Development teams roles regarding implementation of security features in an application.

I have developed several application in Node js and applied below security features. But, these are applicable to any public facing web application developed in any technology.

CORS vulnerability: It is abbreviated as Cross Origin Resource Sharing. Here, generally, our application exposes some APIs to share some data to some particular 3rd party API. So, we should keep a check that whether our exposed APIs are communicating with valid 3rd party APIs or some malicious services. This can be achieved by defining a White List array of 3rd party APIs or domain that will be allowed to interact with our application and rest all will be denied. There are several ways of implementing it. In Node Js, we can use CORS NPM package to implement it. If we are deploying our application in cloud like AWS, these cloud providers different security features like NACL, SecurityGroup
CSRF vulnerability: It is abbreviated as Cross Site Request Forgery. Here, some malicious 3rd party API tries to send a malicious request to your application in such a way that your application assumes that the request is coming from a valid authenticated user. In Node JS application, this vulnerability can be restricted by using CSURF NPM package. Using this package we create a csurf token at Node JS side in a GET method at the very first time when request comes and then this token is sent to client in response body. Now, client should get this token from response body and set it in request header every time it is sending any request to Node JS. On Node JS side, we can define a middleware that will take this token from response header and try to match it with the token generated by Node JS. If it is matching then process the request and if it is not matching then return error response.
Request payload size limit: Defining request payload max size limit on API side is very important. Generally, Node JS API reads the JSON request payload in synchronous mode and if the request payload size is very large then your application might hang or will become very slow. It should be checked before processing any request on nodejs side. If using Express framework, this size can be defined as app.use(express.json({ limit: 10 })). Here request payload size limit is defined as 10 BYTES. The default request payload size limit in EXPRESS is 100KB. I have created a post on it. Its URL is: Node JS application security
File upload size limit: Define max file size limit if your application supports file upload. It can be defined by using Multer package like multer({limits: { fileSize: maxSize }}). Here, maxSize is in BYTES.
Input data sanitization: Generally, the fraud like SQL injection and Javascript injections are done by input form data. This can be minimized by sanitizing the input data on API side before using it. Several NPM packages are available to sanitize input data like express-validator. In any database interaction, we should use parametrized query or any ORM library to minimize the chances of SQL injection.
Restrict XSS(Cross site scripting) attack: This is very much similar to the security issue discussed just above under the heading "Input data sanitization". Here, along with above sanitization measures we can use XSS NPM package to read data from request object.
Use HTTPS instead of HTTP
Authorization: We should follow the least privilege's mechanism with no previlege as Default. This can be implemented either by our own logic by creating tables where we can keep group of users with roles at group level and check the user's group and role before processing any request. Some available NPM package supporting it are @casl/ability, passport etc.
Authentication: Use some well established 3rd party authentication mechanism instead of developing your own from scratch. The example of 3rd party authentication mechanism are like Social media authentication, Authentication using Azure or AWS authentication services. After successful authentication, we should create a JWT token by putting required data in token by encrypting it using Encryption algorithm provided by JWT. This token should be signed and sent to client. It should be properly validated before processing every request.
If any important data is coming from UI to API side it must be encrypted. The encryption key must be there in config file in UI. Same key must be used in API side to decrypt it.
Proper logging: Proper logging should be maintained for each request keeping its user, IP information, timestamp, operation success or failure information etc.
OWASP top ten: The OWASP is an organization that provides the list of top 10 security vulnerabilities of application every year. The details can be found on https://owasp.org/Top10 These top 10 vulnerabilities must be taken care in our application at any cost. The top 10 security vulnerabilities for the year 2021 are as follows:

A01:2021-Broken Access Control: It occurs if we provide unwanted or extra privilege's to an user. It will be restricted by the ways discussed under the heading Authorization above with least privilege's.
A02:2021-Cryptographic Failures: It occurs due to missing required encryption or due to encryption by deprecated or old libraries. It can be restricted by the ways discussed in point (10). The only difference is that the point(10) is talking about data in transit but this is talking about data in transit as well as data in rest. Here, we should use latest cryptographic libraries and always avoid deprecated library like md5 and SHA1.
A03 Injection: It can be restricted by sanitizing request data and using parametrized queries in DB interaction as discussed in point(5 and 6)
A04:2021 – Insecure Design: It is mainly related with Project Design. If project is not designed properly, even best coding practices can not rectify it. There are several tricks to minimize this flaws like using Limiting resource consumption by user or service, writing proper and sufficient unit test and integration test cases, using well established NPM packages.
A05 Security Misconfiguration: Security is very vast and as a software engineer we have to constantly evaluate and upgrade our security feature in our application. We will have to keep verifying all the Cloud security features like SecurityGroup, NACL(Network Access Control Layer), IAM(Identity access management) policy etc. We should keep our 3rd party libs and NPM libs up to date. We should always try to move to the latest version of the programming language and DB if possible.
A06:2021 – Vulnerable and Outdated Components: This can be mainly rectified by using the latest version of our programming language, DB, NPM package and any 3rd party APIs.
A07:2021 – Identification and Authentication Failures: It mainly occurs if we are not able to keep our identity safe or using very week identity credentials like password or forget password question. To rectify it we should force user to make strong password and keep them properly encrypted in transit as well as in rest. Design your application to make it safe from Brute force attacks or automated attacks. If any crucial API is failing for 3 or more times for a particular user then block him for 30 min or slow down the processing for him. This kind of design will help in restricting automated attacks.
A08:2021 – Software and Data Integrity Failures: It is mainly associated with the integrity failure or vulnerabilities related with the 3rd party APIs or NPM packages or CDN we are using in our application. So, if we are using any 3rd Party API, it should be interacted with HTTPS protocol along with proper validation of authentication and authorization tokens. We should use well established NPM package.
A09:2021 – Security Logging and Monitoring Failures: It is associated with missing required logging and monitoring the logs regularly. It can be prevented by using proper logging in every request and setting up some Alarm or event like CloudWatch alarm in case of AWS to get notification via email or SMS about continuous failure of a particular API. In such cases we can validate logs to identify the cause of failure and to get the clue of any security attacks.
A10:2021 – Server-Side Request Forgery (SSRF): It mainly occurs by redirecting user to a different URL. It can be restricted by adding code for properly validating the domain name and port of the URL to ensure whether the domain, host and port are coming in our white list URL before redirecting user to that URL.

Here, I have discussed the minimum required measures that we must take in our application development from security perspective. But, it is not a vast list of security features. There are several more tips and tricks that we can apply in our application. Application security implementation is an ongoing process and development team as well as Business team will have to keep working on it. Its not an one time activity.

In my next post, I will discuss about few other NFR topics.

NFR : None Functional Requirement in Software Engineering or Application Development : Part 2: Scalability, Performance, Testability

jksnu1@gmail.com (Jitendra Kumar Singh) — Sat, 16 Jul 2022 21:35:00 -0700

In my previous post, I had discussed about below points like:

What is NFR
What information should be gathered by Development team from Business team with respect to NFR
Listed down few important NFRs

Link of my NFR related posts:

In the continuation of my previous post about NFR, I am going to discuss about 3 NFR like Scalability, Performance, Testability

Scalability:

Scalability is the measure of a system's ability to increase or decrease in performance and cost in response to changes in application and system processing demands. There are 3 important types scalability:

Horizontal Scaling: New server is added instead of upgrading the existing server.
Vertical Scaling: Existing server is upgraded based by increasing CPU, RAM, Processor
Diagonal Scaling: Here, both horizontal and vertical scaling are done.

Below are few of the ways of implementing scalability in your application:

Setup an alarm like CloudWatch Alarm in AWS that triggers an alarm or event when CPU utilization reaches a thresh hold value
Setup an autoscaling by using cloud autoscale functionality or Kubernates
Load Balancing: Define load balancer to equally distribute load on several servers
Enable clustering if your application technology supports. E.g. if your application is using NodeJs for API creation, we can easily enable clustering as discussed in my below posts like:

Cluster in Node Js application

Cluster management in Node Js application by PM2 Lib

Performance:

It represents the application's throughput time. Lower the throughput time, higher is the performance. Below are few of the ways to enhance your application's performance:

Setup proper load balancer
Use auto-scaling to enhance performance based on CloudWatch alarm
Setup caching like Reddish or memcache
Flush the cache data at certain intervals based on frequency of write operation in the application and how early to present the latest data to customers
Always use Asynchronous operations where synchronous behavior is not required
Follow all coding conventions and guidelines
Follow all best practices of DB like SQL query optimization, using Views, Indexes, Stored Procedures and SQL functions where ever required.
Use some code validation tools like Sonar or Eslint
Try to use latest stable and suitable version of libs like NPM packages

Testability:

In software, testability refers to the degree that any module, requirements, subsystem or other component of your architecture can be verified as satisfactory or not. High testability means it is easy to find and isolate faults as part of your team's regular testing process. Our application must have following criteria to be more testable:

Controllability: The degree to which it is possible to control the state of the component under test (CUT) as required for testing.
Observability: The degree to which it is possible to observe (intermediate and final) test results.
Isolateability: The degree to which the component under test (CUT) can be tested in isolation.
Separation of concerns: The degree to which the component under test has a single, well defined responsibility
Understandability: The degree to which the component under test is documented or self-explaining.
Automatability: The degree to which it is possible to automate testing of the component under test.
Heterogeneity: The degree to which the use of diverse technologies requires to use diverse test methods and tools in parallel.

In my next post, I will discuss about NFR related with Application security.

NFR : None Functional Requirement in Software Engineering or Application Development : Part 1

jksnu1@gmail.com (Jitendra Kumar Singh) — Fri, 4 Mar 2022 05:50:00 -0800

Here is the link of all of my posts on topic NFR:

Links:

NFR(None Functional Requirement) is abbreviated as Non Functional Requirement. In any application development or maintenance work, the NFRs are least discussed but most required activities. Generally, the NFRs of an application are not discussed by Business team. Its Developer's team's responsibility to discuss all the NFRs with business teams and try to understand and create a document of the discussion regarding NFRs implementation with Business team. There may be several discussion points regarding NFRs with Business team like:

Expected minimum or maximum load on application
What is the pick time and off pick time of the application usage
Is the application public facing or only client's employee facing
Application downtime required for build deployment or any upgradation
Response throughput in terms of millisecond required for a feature
Negotiation in business requirement to achieve the required throughput.
Whether the application's feature is read extensive or write extensive to decide how frequently data should be flushed in caching if caching is implemented
Whether customer requires latest data as soon as it is updated in system to decide whether to implement caching
Cost of any 3rd party API that Business can bear.
Cost of skilled resources that Business should bear till the time the application becomes stable(Should be discussed more by Management team)
Tradeoff analysis and discuss with Business team about conflict between different NFRs.

There are several types of Non Functional Requirements. Few important NFRs are as follows:

Scalability
Performance
Testability
Security
Extensibility
Observability
Maintainability

The actual list of NFRs are very vast. Here, I have included only few that are mostly required to be considered in Application development.

In my next blog, I will discuss about the above mentioned NFRs in short.

Node Express application Security: Set Request Size Limit for JSON data and file uploading

jksnu1@gmail.com (Jitendra Kumar Singh) — Fri, 4 Mar 2022 05:37:00 -0800

Here, we are going to discuss about securing our Node Express application if any unwanted user tries to impact performance of our application by sending a very huge input JSON data or by uploading a very large file.

Generally, Express allows 100KB JSON data by default. If we try to input more than 100KB JSON data, it will return 413 error code. In case of file uploading by using Multer package, there is not any defult file size limit. So, in can case of file uploading, we should apply some file size limit in Node Js code. Lets discuss about JSON input data and file uploading separately.

JSON input data: As told above, Express allows by default 100KB JSON data which is pretty good in most of the scenarios. If in some scenarios, we need to send JSON data of size more than 100KB, then we have to increase the default JSON data size limit. We can achieve it by using the below two middlewares.

app.use(express.json({limit: '10mb', extended: true}));
app.use(express.urlencoded({limit: '10mb', extended: true})); 

Now, this express application will allow us to send JSON data of up to 10mb size.

File upload size limit: Generally, we use Multer package to upload incoming files. Here, we can restrict the security threat by providing the max file size limit in multer. It can be done in the following way.

const multer = require('multer');

const upload = multer({limits: { fileSize: 1024 * 1024 * 150 }}); //150Mb

Here, we are defining the maximum allowed file size limit as 150mb. This size applies for both single file upload and multiple file upload. So, if we are uploading a single file of size say 200mb or two files together with each file having size about 100mb that is 100+100=200mb then, in both the cases, the file size limit is exceeding the defined file size that is 150mb. So, in these cases, it will give error with 500 status code with error message as "File too large".

I have created below two routes for handling single file upload and multiple file upload.

app.post('/singleFileUpload', upload.single("file"), (req, res) => {
  const jsonData = req.body;
  res.status(200).json({
    "status": "success"
  });
});

app.post('/multipleFileUpload', upload.array("file"), (req, res) => {
  const jsonData = req.body;
  res.status(200).json({
    "status": "success"
  });
});

Here, I am giving my code that will help in reproducing the outcome of above discussion.

package.json

{
  "name": "node_test",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1",
    "start": "nodemon ./app"
  },
  "author": "",
  "license": "ISC",
  "dependencies": {
    "express": "^4.17.3",
    "multer": "^1.4.4",
    "nodemon": "^2.0.15"
  }
}

app.js

const express = require('express');
const multer = require('multer');
const app = express();
const upload = multer({limits: { fileSize: 1024 * 1024 * 150 }}); //50Mb

//middleware
app.use(express.json({limit: '10mb', extended: true}));
app.use(express.urlencoded({limit: '10mb', extended: true})); 

const port = 3000;

app.get('/', (req, res) => {
  res.status(200).json({
    "status": "success"
  });
});

app.post('/bigJson', (req, res) => {
  const jsonData = req.body;
  res.status(200).json({
    "status": "success",
    "jsonData": jsonData
  });
});

app.post('/singleFileUpload', upload.single("file"), (req, res) => {
  const jsonData = req.body;
  res.status(200).json({
    "status": "success"
  });
});

app.post('/multipleFileUpload', upload.array("file"), (req, res) => {
  const jsonData = req.body;
  res.status(200).json({
    "status": "success"
  });
});

app.listen(port, () => {
  console.log("Server has started");
});

Publish message to AWS SQS queue by NodeJs

jksnu1@gmail.com (Jitendra Kumar Singh) — Wed, 9 Feb 2022 02:29:00 -0800

Here, we will discuss about how to publish messages to AWS SQS queue by NodeJs. To implement it, we have to follow below steps:

Create an user in AWS and note down its access key Id and secret access key
Create a SQS queue and note down its url
Save user credential in a shared file in your local
Install aws-sdk library
Create a simple node express application with route for publishing message to SQS

Now, lets discuss each steps one by one.

1) Create an user in AWS and note down its access key Id and secret access key: I have discussed in detail about this steps in my previous blog under the heading "File handling in AWS S3 by NodeJs". I am giving the link below. Please go through it.

Create an user in IAM service in AWS

2) Create a SQS queue and note down its url: First open AWS console and go to the SQS service and click on the "Create Queue" button. Now, add the Queue name and keep other things with default value. Further click on "Create Queue" button at the bottom.

3) Save user credential in a shared file in your local: In this steps, we should save the user credential so that node js application can read it while establishing connection with AWS. We can refer below AWS documentation for this step:

Save User Credentials

5) Install aws-sdk library: Create a simple node js application and Use the command like npm install aws-sdk

6) Create a simple node express application with route for publishing message to SQS: Here, we are creating a very simple node express application along with two routes:

a) "/addMessage": This is being used to add messages in SQS queue.

b) "/getMessage": This is being used to get messages from the SQS queue.

I am providing here the code for your reference:

const express = require('express');
const dotenv = require('dotenv');
const path = require('path');
const AWS = require('aws-sdk');

AWS.config.update({region: 'us-east-1'});
const sqs = new AWS.SQS();

const app = express();
app.use(express.json());

dotenv.config({
  path: path.join(__dirname, './.env')
});

app.listen(8000, () => {
  console.log(`Listening port 8000`);
});

//Add a message to SQS
app.post('/addMessage', async(req, res) => {
  try {
    const params = {
      MessageBody: req.body.MessageBody,
      QueueUrl: process.env.SQS_URL
    };
    const result = await sqs.sendMessage(params).promise();
    res.send(result)
  } catch (error) {
    console.log(error);
    throw error;
  }  
});

//Receive a message to SQS
app.get('/getMessage', async(req, res) => {
  try {
    const params = {
      QueueUrl: process.env.SQS_URL
    };
    const result = await sqs.receiveMessage(params).promise();
    res.send(result)
  } catch (error) {
    console.log(error);
    throw error;
  }  
});

Publish and subscribe to AWS SNS topic through NodeJS

jksnu1@gmail.com (Jitendra Kumar Singh) — Mon, 7 Feb 2022 23:01:00 -0800

Today, we are going to discuss how to publish a message to AWS SNS topic and how to subscribe to the SNS topic so that the subscriber gets the messages published to the SNS topic. We should follow the below steps:

Create an user and user group and note down its accessKeyId and secretAccessKey
Assign this user the required permission for SNS handling
Create a topic and note down its ARN
Install aws-sdk libraray
Save user credential in a shared file in your local
Create a simple node express application and create routes for publish and subscribe

Now, lets discuss about each steps here:

1) Create an user and user group and note down its accessKeyId and secretAccessKey: I have discussed in detail about this steps in my previous blog under the heading "File handling in AWS S3 by NodeJs". I am giving the link below. Please go through it.

Create an user in IAM service in AWS

2) Assign this user the required permission for SNS handling: Here, we can create a custom policy for SNS handling and then assign it to the group to which the user belongs or we can assign a default SNS policy already provided by AWS. Here, I am going to assign default SNS policy.

First, go to the IAM service in AWS console and then click on your User name to whom you want to provide permission.

Now, click on Add permissions button and then click on "Attach existing policies directly". Now, search for SNS and select "AmazonSNSFullAccess".

Important Note: This policy selection is only for demo purpose. In real time, we should provide the least required access for any service to an user. Always avoid providing the full access.

3) Create a topic and note down its ARN: Now, go to the SNS service in AWS console and click on the Topics tab present in the left side. Further, click on the Create topic button. In the create topic window, select "Standard" radio button and add your Topic name and display name. You can keep rest of the fields as default.

Now, your topic will be created. You should note down the ARN of the topic. It is going to be used in NodeJS code.

4) Install aws-sdk libraray: Use the command like npm install aws-sdk

5) Save user credential in a shared file in your local: In this steps, we should save the user credential so that node js application can read it while establishing connection with AWS. We can refer below AWS documentation for this step:

Save User Credentials

6) Create a simple node express application and create routes for publish and subscribe: Here, we should create a node js and express application and expose two routes.

One is used to subscribe the email id to the SNS topic represented by the ARN of the topic in the code. Once, the route is triggered, it will trigger SNS service to subscribe the given email id to the SNS topic. You will get a confirmation email on this email id from AWS. This email will have a link and you will have to click on the link to complete the subscription.

Second route is used to publish message to the SNS topic and further SNS topic will forward the message to all the subscribed emails. Here, we have to provide the Subject and Body as a part of message.

I am giving here the code for your reference:

const express = require('express');

const dotenv = require('dotenv');

const path = require('path');

const AWS = require('aws-sdk');

AWS.config.update({region: 'us-east-1'});

const sns = new AWS.SNS();

const app = express();

app.use(express.json());

dotenv.config({

  path: path.join(__dirname, './.env')

});

app.listen(8000, () => {

  console.log(`Listening port 8000`);

});

//Get sns details

app.get('/mysns', (req, res) => res.send({"status":"Ok", sns}));

//Subscribe SNS topic

app.post('/subscribe', async(req, res) => {

  try {

    const params = {

      Protocol: 'Email',

      TopicArn: process.env.TOPIC_ARN,

      Endpoint: req.body.email

};

    const result = await sns.subscribe(params).promise();

res.send(result);

  } catch (error) {

    console.log(error);

    throw error;

}

});

//Publish to SNS topic

app.post('/publish', async(req, res) => {

  try {

    const params = {

      Subject: req.body.subject,

      TopicArn: process.env.TOPIC_ARN,

      Message: req.body.message

};

    const result = await sns.publish(params).promise();

res.send(result);

  } catch (error) {

    console.log(error);

    throw error;

}

});

File handling in AWS S3 by Node Js

jksnu1@gmail.com (Jitendra Kumar Singh) — Sun, 6 Feb 2022 22:51:00 -0800

Today, I am going to discuss about file handling operations like upload a file, get list of all the files, delete a file and download files from S3 bucket in AWS. To perform all these operation, we should follow the below steps:

Create an user in IAM service in AWS
Create a bucket in S3 service in AWS
Save user credential in a shared file in your local
Create a NodeJS application
Install aws-sdk package
Create routes for handling files

Now, lets discuss about each steps here.

1) Create an user in IAM service in AWS: We should go to the IAM service in AWS and click on "Add users button".

Add the user name and select the check box for "Access key - Programmatic access" and then click on "Next: Permissions"

Click on the "Create group" button and then add a group name and then click on Create group button.

Now, on group list page, click on your newly created group and then click on Permissions tab. Now, Add Permissions dropdown box and click on attach Policy.

Now, click on Create Policy and select service as S3. Further, select check boxes of Read, List and Write

So, up to here, your user and required group and policy is created. Now, note down the user access key id and secret access key. These two keys are going to be used in NodeJS programming.

2) Create a bucket in S3 service in AWS: Now, we should go to the S3 service of AWS and create a bucket with unique name in AWS.

Save User Credentials

4) Create a NodeJS application: Here, create a very simple node js application with Express. Code will be given in the below.

5) Install aws-sdk package: In your node js application, install aws-sdk package by using command like npm install aws-sdk

6) Create routes for handling files: Below is the code for different routes like upload a file in S3, get list of all the files from the S3 bucket, delete a file, download a file.

const express = require('express');
const dotenv = require('dotenv');
const path = require('path');
const multer = require('multer');
const AWS = require('aws-sdk');

const s3 = new AWS.S3();
const app = express();
const upload = multer();
dotenv.config({
  path: path.join(__dirname, './.env')
});

app.listen(8000);

//Creating routes
//uploading file to s3
app.post('/upload', upload.single('file'), async (req, res) => {
  try {
    const result = await s3.putObject({
      Body: req.file.buffer,
      Bucket: process.env.BUCKET_NAME,
      Key: req.file.originalname
    }).promise();
    res.send(result);
  } catch (error) {
    console.log(error);
    throw error;
  }  
});

//Listing uploaded files
app.get('/fileList', async(req, res) => {
  try {
    const result = await s3.listObjectsV2({
      Bucket: process.env.BUCKET_NAME
    }).promise();
    res.send(result);
  } catch (error) {
    console.log(error);
    throw error;
  }
});

//Deleting a file
app.delete('/deleteFile/:fileName', async(req, res) => {
  try {
    const fileName = req.params.fileName;
    const result = await s3.deleteObject({
      Bucket: process.env.BUCKET_NAME,
      Key: fileName
    }).promise();
    res.send(result);
  } catch (error) {
    console.log(error);
    throw error;
  }
})

//Download a file
app.get('/downloadFile/:fileName', async(req, res) => {
  try {
    const fileName = req.params.fileName;
    const result = await s3.getObject({
      Bucket: process.env.BUCKET_NAME,
      Key: fileName
    }).promise();
    res.send(result.Body);
  } catch (error) {
    console.log(error);
    throw error;
  }
})