# immunio > IMMUNIO protects your web app from security vulnerabilities by monitoring requests in realtime. After a two minute installation, your application will be protected from many of the top classes of attacks, including Cross-Site Scripting (XSS), SQL Injectio Latest version **1.5.3** (published 2020-01-07) · SEE LICENSE IN LICENSE license · 0 weekly downloads ## Install ```sh npm install immunio pnpm add immunio yarn add immunio bun add immunio ``` ## Health **Score 15/100 (F)** — status: abandoned. Positive: no vulnerabilities. Warnings: low downloads; no types; no esm support. Negative: abandoned; low maintenance score. ## Facts | | | |---|---| | Version | 1.5.3 | | Published | 2020-01-07 | | First published | 2016-03-24 | | Weekly downloads | 0 | | License | SEE LICENSE IN LICENSE | | TypeScript types | none | | Module format | CommonJS | | Dependencies | 10 | | Unpacked size | 4.4 MB | | Known vulnerabilities | 0 (+1 in 1 direct dependencies) | | Install scripts | yes | | Author | Immunio | | Maintainers | macournoyer, secretmike, stlef14 | | Keywords | security | ## Links - npm: https://www.npmjs.com/package/immunio - Homepage: https://www.immun.io - npm.io page: https://npm.io/package/immunio ## Dependencies (10) - [nan](https://npm.io/package/nan.md) 2.x - [tunnel](https://npm.io/package/tunnel.md) ^0.0.4 - [msgpack](https://npm.io/package/msgpack.md) ^1.0.2 - [winston](https://npm.io/package/winston.md) ^2.1.1 - [bindings](https://npm.io/package/bindings.md) ^1.2.1 - [lru-cache](https://npm.io/package/lru-cache.md) ^4.0.0 - [node-uuid](https://npm.io/package/node-uuid.md) ^1.4.7 - [constantinople](https://npm.io/package/constantinople.md) ~3.0.1 - [character-parser](https://npm.io/package/character-parser.md) 1.2.1 - [continuation-local-storage](https://npm.io/package/continuation-local-storage.md) ^3.1.4 ## Recent versions - 1.5.3 (latest) — 2020-01-07 - 1.5.2 — 2019-07-31 - 1.5.1 — 2019-01-21 - 1.5.0 — 2018-10-30 - 1.2.0 — 2017-05-18 - 1.1.0 — 2017-02-16 - 1.0.4 — 2017-01-30 - 1.0.3 — 2017-01-12 - 1.0.2 — 2017-01-11 - 0.0.0 — 2016-03-24 ## README # Immunio Node Agent ## Support Matrix | Feature | Required package & version _*_ | Note | | ----------------------------- | -------------------------------- | ---- | | All features | Node >= 0.12 || | SQLi | Sequelize >= 2.1, pg 4.x, pg-native, mysql 2.x, sqlite3 3.x || | NoSQLi | Mongoose 4.x, mongodb 2.x | | | XSS | Jade >= 1.3, Mustache >= 2.1 || | Session, Redirect | express-session, cookie-session || | Authentication | Passport 0.3 || | CSRF | csrf 3.x || | Cookie Tampering | cookie-parser 1.4 with Express || _* Tested versions. Other versions might also work._ ## Installation From the root of your Node app: $ npm install --save immunio ## Installation from source From the root of your Node app: $ npm link /path/to/agent-node ## Usage To active Immunio, add the following as the first line of your app setup code: ```js var immunio = require('immunio'); ``` ## Configuration The agent key and secret can be configured via the `IMMUNIO_KEY` and `IMMUNIO_SECRET` environment variables. If you are using a configuration file instead of using environment variables, it needs to be called immunio.json be in the application root folder and needs to contain the follow *immunio.json*: ```json { "key": "my-key", "secret": "my-secret" } ``` *Note:* The environment variables will take precedence over the configuration file. ## Authentication API If you're using [Passport](http://passportjs.org/), Immunio will automatically hook into your authentication system to protect you against attacks. If you're not using the above framework, you will need to manually tell Immunio when authentication occurs. Use the following methods to do so. - After a user logs in: `immunio.authentication.login(user, req)` - After a failed login attempt: `immunio.authentication.failedLogin(user, req)` - After a user logs out: `immunio.authentication.logout(user)` - After the current user is changed (or set): `immunio.authentication.setUser(user, req)` - After a user requests a password reset: `immunio.authentication.passwordReset(user, req)` - After a failed requests for resetting a password: `immunio.authentication.failedPasswordReset(user, req)` **Note:** `immunio.authentication.setUser(user, req)` should be called for every request where user data is available, not just when authentication mechanisms are used. These methods take a `user` object with the following properties their first argument: * `user_id`: String or Number * `username`, `login` or `name`: String * `email`: String * `reason`: String (for failures) The second argument should be the Node HTTP request (`req`) or response (`res`) object, if available. Here's an example: ```js var immunio = require('immunio'); // ... app.use(function(req, res, next) { // Assuming req.user is populated with the current user in a previous middleware. if (req.user) { immunio.authentication.setUser(req.user, req); } }); app.post('/login', function(req, res) { var username = req.body.username; var password = req.body.password; db.findUser(username, password, function(err, user) { if (err) { // On failed login // ... immunio.authentication.failedLogin({ username: username }, req); } else { // On successful login // ... immunio.authentication.login({ user_id: user.id, username: user.name, email: user.email }, req); } }); }); app.get('/logout', function(req, res) { // Get the current user var user = req.user; immunio.authentication.logout({ user_id: user.id, username: user.name, email: user.email }, req); // Your logout code ... }); ``` ## Waiting for Agent readiness By default your app will start before Immunio is ready to protect it. If you want to prevent this behavior and wait for Immunio to be fully active before starting your app, use the following: ```js var immunio = require('immunio'); // ... immunio.on('ready', function() { // Start your web server here. server.listen(port); }); ``` --- _Source: https://npm.io/package/immunio · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._