All language subtitles for 023 Preventing Parameter Pollution_Downloadly.ir_en

Welcome to the last video of this section.

And in this one, we're gonna be

preventing parameter pollution,

using yet another NPM package.

But before installing that package, let's go ahead

and take a look at the error.

But before doing that, let's head over to Postman

and see why we actually need

to prevent parameter pollution in the first place.

So, first up, we need to log in.

Okay, so, with this user and this password.

So now we can use the Get All Tours route.

All right, and so what I'm gonna do now here

is to add some parameters to the query string.

So let's see, I want to sort by duration,

and at the same time, I also want to sort by price.

And it doesn't actually make much sense right

because we're prepared to only have one sort parameter.

So let's see what we actually get with this.

And indeed we get an error saying that this

.querystring.sort.split is not a function.

And so that's happening in the apiFeatures.js in line 23.

So let's open that

and so here, on line 23 is where that error occurs.

So it's trying to split the sort property here,

which we expect to be a string.

But right now since we defined it twice,

so sort once and then sort twice, express will actually

create an array with these two values, duration and price.

Let me actually show that to you.

Console.log.

Now I'm copying it.

Okay, try it again.

Here's the same error and as I said it is actually

an array with duration and price.

And so that of course, we cannot split

because split only works on strings, okay?

And so this is a typical problem which attackers

can then make use of.

All right, and so basically we're now going to use

a middleware which will simply

remove these duplicate fields, okay?

And that one, let's install it.

It is called HPP which stands for

HTTP Parameter pollution.

All right.

Let's quickly require it here.

All right, and so, this is yet another very simple one.

All we need to do is app.use and then call HPP.

So, prevent parameter pollution.

And this one again should be used here by the end, okay,

because what it does is to clear up

the query string, all right?

So let's try that again.

It's taking a bit of time, and here we go.

So the error is gone

and so now it's only using the last one.

So it's sorting my price now and indeed we start

with the lowest one and then moving up 497,

all the way to the most expensive one

of almost 3000, all right?

So that's kind of fixed but we actually want

some duplicate properties or fields in some cases, right?

For example we might want to search for tours

with the duration of nine and five.

So remember that in our API, we can do this,

so duration equals five, and we can say,

at the same time, duration nine, okay?

And we want this actually to work but right now it doesn't.

It only finds the tour with nine days, right?

But if we hadn't, or HPP middleware.

So let's deactivate it.

So if we didn't have it active,

then we would find three tours, one with duration five,

then here with duration nine

and here another one with duration five.

Okay, and so in this case,

this is actually the expected behavior.

So what we can do in order to be able

to use the middleware but still get this result

that we expect here, with the duration,

we can white list some parameters, okay?

So into this HPP function, we can once more pass

an object and then in there, specify the white list, okay?

And the white list is simply an array of properties

for which we actually allow duplicates in the query string.

Okay?

And to duration is of course one of them, all right?

So, let's try that again.

And so, right now we still get our three results as before.

But if we tried it with sort,

and let's create a new tab here.

So if we tried it with these double sorts,

then we should also get no error.

Well now were not logged in,

so let's just get our error token here.

Try that again.

And now indeed it works, we get no error.

And so that HPP middleware is doing it's job.

All right?

Also close up this one, and now we should also

specify some other fields in our white list,

because for example we want to search for this one as well,

or the ratings quantity.

And so let's just copy all of them here into our white list.

So the average as well.

Then also duration we already have,

and let's say max group size.

We might also want the difficulty.

And also the price.

And I think that should then be enough.

All right.

And it might seem a bit weird to basically manually

put all the field names here and later we might

have to do the same thing for the other resources,

and that will then make this white list even bigger, right?

And of course we could do some complex stuff

here in order to get these field names

from the model itself, but once more,

I just want to keep it simple here, okay?

And so I'm just manually defining these field names here

and then call it a day, all right?

Okay, and that actually wraps up our authentication,

authorization and security section.

And if you wanna have some more fun with it, then of course,

you can try to implement some of the stuff

that I suggested in that summary video

that I showed you before with that slide

with all these different security measures

that we already implemented and some of which

I told you to experiment with.

So feel free to do that, or if not,

well then let's just together move on to the next section

which is gonna be a really exciting one again

because we will then really start modeling the data

and learn some more really advanced MongoDB stuff.

So I can't wait to see you there.