Simple wrapper on top of serveStatic, that allows serving pre-gzipped files as well as other types of compressions.
Installations
npm install express-static-gzip
Developer Guide
Typescript
Yes
Module System
CommonJS
Node Version
20.11.1
NPM Version
10.2.4
Score
95.2
Supply Chain
98.5
Quality
79.2
Maintenance
100
Vulnerability
100
License
Releases
Contributors
Unable to fetch Contributors
Languages
JavaScript (99.86%)
HTML (0.07%)
Scilab (0.04%)
CSS (0.03%)
Developer
tkoenig89
Download Statistics
Total Downloads
19,696,914
Last Day
5,859
Last Week
33,964
Last Month
340,923
Last Year
4,752,491
GitHub Statistics
147 Stars
150 Commits
28 Forks
2 Watching
3 Branches
17 Contributors
Bundle Size
65.75 kB
Minified
20.96 kB
Minified + Gzipped
Package Meta Information
Latest Version
2.2.0
Package Id
express-static-gzip@2.2.0
Unpacked Size
23.80 kB
Size
7.47 kB
File Count
7
NPM Version
10.2.4
Node Version
20.11.1
Publised On
10 Nov 2024
Total Downloads
Cumulative downloads
Total Downloads
19,696,914
Last day
-11.8%
5,859
Compared to previous day
Last week
-52%
33,964
Compared to previous week
Last month
-11.5%
340,923
Compared to previous month
Last year
10.7%
4,752,491
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
express-static-gzip
Provides a small layer on top of serve-static, which allows to serve pre-gzipped files. Supports brotli and allows configuring any other compression you can think of as well.
If express-static-gzip
saved you some time, feel free to buy me a cup of coffee :)
Requirements
For the express-static-gzip
middleware to work properly you need to first ensure that you have all files gzipped (or compressed with your desired algorithm) which you want to serve as a compressed version to the browser.
Simplest use case is to either have a folder with only .gz files, or you have a folder with the .gz files next to the original files. Same goes for other compressions.
Install
1 $ npm install express-static-gzip
Changelog for v2.0
-
Even so this is a mayor release, this should be fully backwards compatible and should not have any breaking change to v1.1.3.
-
Moved all options for
serveStatic
in its own section (serveStatic
) to prevent collisions when setting up your static fileserving middleware. -
For backwards compatibility all root options that apply to
serveStatic
will be copied to the newserveStatic
section, except if you have set values there already (no overwrite). Here is a small example of this behaviour:1{ 2 enableBrotli: true, // not a serverStatic option, will not be moved 3 maxAge: 123, // not copied, as already present. 4 index: 'main.js', // copied to serveStatic section 5 serveStatic: { 6 maxAge: 234, // will be kept 7 cacheControl: false // will be kept as well 8 } 9}
In the above scenario serveStatic will use
cacheControl
: false,index
: 'main.js',maxAge
:234.
Usage
In case you just want to serve gzipped files only, this simple example would do:
1var express = require("express"); 2var expressStaticGzip = require("express-static-gzip"); 3var app = express(); 4 5app.use("/", expressStaticGzip("/my/rootFolder/"));
While gzip compression is always enabled you now have the choice to add other types of compressions using the options object. Currently brotli can be enabled using the options.enableBrotli flag.
All other compressions need to be added by passing an array to options.customCompressions.
The options.serveStatic section is passed to the underlying serve-static
middleware, in case you want to configure this one as well.
The following example will show how to add brotli and deflate (with file extension .zz) to the middleware (it will still support gzip) and force brotli to be used if available (orderPreference
):
1var express = require('express'); 2var expressStaticGzip = require('express-static-gzip'); 3var app = express(); 4 5app.use('/', expressStaticGzip('/my/rootFolder/', { 6 enableBrotli: true, 7 customCompressions: [{ 8 encodingName: 'deflate', 9 fileExtension: 'zz' 10 }], 11 orderPreference: ['br'] 12}));
Compressions are selected in the following order if a file is requested from the middleware:
- any encoding listed in
option.orderPreference
and supported by the client - in order of the requests 'accept-encoding' header content (if no quality if provided)
- in order of their respective quality (if provided)
- in case of a wildcard '*', the compression is selected in alphabetical order (for now)
- plain file (in case no compression exists or none is matching the browsers accept-encoding header)
For more details see here, but not all of it is implemented at the moment.
When the middleware is created it will check the given root folder and all subfolders for files matching the registered compression. Adding files later to the folder will not be recognized by the middleware.
Available options
-
enableBrotli
: boolean (default: false)Enables support for the brotli compression, using file extension 'br' (e.g. 'index.html.br').
-
index
: boolean | string (default: 'index.html')By default this module will send "index.html" files in response to a request on a directory (url ending with '/'). To disable this set false or to supply a new index file pass a string (like 'index.htm').
-
customCompressions
: [{encodingName: string, fileExtension: string}]Using this option, you can add any other compressions you would like.
encodingName
will be checked against theAccept
-Header.fileExtension
is used to find files using this compression.fileExtension
does not require a dot (not'.gz', but'gz'
). -
orderPreference
: string[]This options allows overwriting the client's requested encoding preference (see MDN) with a server side preference. Any encoding listed in
orderPreference
will be used first (if supported by the client) before falling back to the client's supported encodings. The order of entries inorderPreference
is taken into account. -
serveStatic
: ServeStaticOptionsThis will be forwarded to the underlying
serveStatic
instance used byexpressStaticGzip
Behavior warning
In default mode a request for "/" or "<somepath>/" will serve index.html as compressed version. This could lead to complications if you are serving a REST API from the same path, when express-server-static is registered before your API.
One solution would be to register express-server-static last. Otherwise you can set options.index to false:
1app.use("/", expressStaticGzip("/my/rootFolder/", { index: false }));
Because this middleware was developed for a static production server use case to maximize performance, it is designed to look up and cache the compressed files corresponding to uncompressed file names on startup. This means that it will not be aware of compressed files being added or removed later on.
Example
In case you have the following basic file structure
- rootFolder
- index.html
- index.html.gz
- index.html.br
- test.html.gz
- main.js
and you use set the enableBrotli flag to true, express-static-gzip will answer GET requests like this:
GET / >>> /my/rootFolder/index.html.br
GET /index.html >>> /my/rootFolder/index.html.br
GET /test.html >>> /my/rootFolder/test.html.gz
GET /main.js >>> /my/rootFolder/main.js
No vulnerabilities found.
Reason
no binaries found in the repo
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE.md:0
- Info: FSF or OSI recognized license: MIT License: LICENSE.md:0
Reason
5 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 5
Reason
dependency not pinned by hash detected -- score normalized to 3
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/tkoenig89/express-static-gzip/nodejs.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/tkoenig89/express-static-gzip/nodejs.yml/master?enable=pin
- Info: 0 out of 2 GitHub-owned GitHubAction dependencies pinned
- Info: 1 out of 1 npmCommand dependencies pinned
Reason
Found 2/16 approved changesets -- score normalized to 1
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/nodejs.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 18 are checked with a SAST tool
Reason
10 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-4q6p-r6v2-jvc5
- Warn: Project is vulnerable to: GHSA-896r-f27r-55mw
- Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-vh95-rmgr-6w4m / GHSA-xvch-5gv4-984h
- Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
- Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
Score
3.6
/10
Last Scanned on 2024-12-30
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn MoreOther packages similar to express-static-gzip
connect-static-file
connect and express middleware to serve a single static file
express-static-gzip-nesto
simple wrapper on top of express.static, that allows serving pre-gziped files
static-gzip
Connect/Express middleware for compressing static files with gzip
express-precompressed
A simple middleware for serving folders of compressed or uncompressed files