![](\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/devops\/22\/f\/grpc-api-tutorial\/build-first-node-tn.jpg\")
<\/p>\n<\/p>\n
What is gRPC?<\/span><\/p>\n Google Remote Procedure Call (gRPC) is a remote procedure call framework that eases the communication process between client and server applications. It\u2019s high-performing, robust, and lightweight.<\/p>\n These three qualities are due to its data exchange format and the interface definition language used by protocol buffers (protobufs). Protobufs are small and fast due to their data serialization format, which enables smaller packets. This makes them highly suitable for fast data flow and economical storage.<\/p>\n Before building the application program interface (API), it’s important to understand the features that give gRPC an upper hand over other API technologies like REST and GraphQL.<\/p>\n What are the features of gRPC?<\/span><\/p>\n The distinguishing features of gRPC are:<\/p>\n This article will demonstrate how to develop a basic Node.js gRPC API that salts and hashes a password received from a client endpoint. Also, it will give an overview of some of the potential security pitfalls of gRPC and the best practices for avoiding them.<\/p>\n Prerequisites While not mandatory, JavaScript knowledge is also quite helpful.<\/p>\n Creating the API npm init -y<\/span><\/p>\n Next, install the required libraries. Both grpc-js and protoc are two open-source libraries that enable you to use gRPC in Node.js. Install them by running these commands:<\/p>\n npm i @grpc\/grpc-js Next, create three files: one for the protobuf definition, one for the client stub, and one for the server code. You can do this using the following command:<\/p>\n touch server.js client-stub.js password.proto<\/span><\/p>\n As the names suggest, server.js contains the server code, client-stub.js, the client code, and the protobuf definition are in the password.proto file.<\/p>\n Writing the protobuf definition<\/b><\/p>\n In the password.proto file, paste the following code:<\/p>\n syntax = “proto3”; The code starts by specifying the syntax version of the protocol buffers. Then, it creates a message definition for a password\u2019s details. You must send all commands to a gRPC API contained in a service. So, in this case, PasswordService contains the commands needed for this tutorial. <\/p>\n The commands taking in and returning message replies are for adding a new password, editing, and reading passwords. The messages passed or replied to and from the endpoints can be empty (Empty) or contain some message. The rest of the message definitions added are for representing empty messages and a list of passwords.<\/p>\n The server code<\/b><\/p>\n Start by importing the required modules and your proto file:<\/p>\n const grpc = require(“@grpc\/grpc-js”); Then, initialize an object for storing the protobuf loader (protoLoader) options in this manner:<\/p>\n const loaderOptions = { The above fields do the following:<\/p>\n You can find more information about setting the options object here<\/a>.<\/p>\n Next, initialize the package definition object by passing the protobuf file and the options object in the protobuf loader\u2019s loadSync method:<\/p>\n \/\/ initializing the package definition To create a gRPC object, call the grpc-js method, loadPackageDefinition while passing in the previously created package definition. Use the object to invoke the gRPC service and, eventually, the commands.<\/p>\n const grpcObj = grpc.loadPackageDefinition(packageDef);<\/span><\/p>\n But before that, you must invoke your Node.js server to add the gRPC services to it. Do that using this line:<\/p>\n const ourServer = new grpc.Server();<\/span><\/p>\n The first two default passwords are in a JavaScript object. Here, you can use your own logic and retrieve data from your storage engine. It can be a database, a serverless platform\u2019s data retrieval logic, a file, and so on.<\/p>\n let dummyRecords = { Add the service and the commands using the code below:<\/p>\n ourServer.addService(grpcObj.PasswordService.service, { The addService method takes in two parameters: the service, and the commands. Each of the commands takes in a message argument (as defined in the proto file) and a callback function argument. The callback function passes the replies from the commands to the client.<\/p>\n The retrievePasswords method returns all passwords stored in the object. The addNewDetails method inserts new password details to the inner array of your object using the Array.prototype.push method from the message request. <\/p>\n To update a password\u2019s details, the ID of the password comes from the request. The Array.prototype.find method retrieves the details to update using the request details passed in the command, updates the retrieved details, and returns the updated details to the client.<\/p>\n Finally, bind the server to a port and start it using the bindAsync method.<\/p>\n ourServer.bindAsync( The client code<\/b><\/p>\n Now you\u2019re ready to salt and hash your passwords. To help achieve this, you need a library called bcrypt. Install it using this command:<\/p>\n npm i bcrypt<\/span><\/p>\n Just like the server code, start by importing the required modules. You create the package definitions and the gRPC object in the same way.<\/p>\n const grpc = require(“@grpc\/grpc-js”); You create the client stub by passing the server address and the server connection credentials to the service name constructor.<\/p>\n const clientStub = new PasswordService( Invoke the commands by passing in the messages as the first parameter and the callback function as parameters. The retrievePasswords service command illustrates this.<\/p>\n clientStub.retrievePasswords({}, (error, passwords) => { You generate a salt using the bcrypt.genSalt method by passing in the salt rounds you need. You generate a hash using the bcrypt.hash method by passing in the password and the salt values. In each method, there is a callback function containing any encountered error message, if found, and the result. Set the hash and salt values inside the method bodies as shown.<\/p>\n const saltRounds = 10; You should do the hashing and salting on the server. Here, you did the processes in the client just for demonstration purposes. You can learn more about salting and hashing here<\/a>.<\/p>\n Then, run the application by starting the server using the command below:<\/p>\n\n
<\/span>
To best follow this walkthrough, the following prerequisites are required:<\/p>\n\n
<\/span>In the working directory, create a folder named node-grpc. Open the folder and your favorite terminal. Then start the node by running the command below:<\/p>\n
npm i @grpc\/proto-loader<\/span><\/p>\n
message PasswordDetails {
string id = 1;
string password = 2;
string hashValue = 3;
string saltValue = 4;
}
service PasswordService {
rpc RetrievePasswords (Empty) returns (PasswordList) {}
rpc AddNewDetails (PasswordDetails) returns (PasswordDetails) {}
rpc UpdatePasswordDetails (PasswordDetails) returns (PasswordDetails) {}
}
message Empty {}
message PasswordList {
repeated PasswordDetails passwords = 1;
}<\/span><\/p>\n
const protoLoader = require(“@grpc\/proto-loader”);
const PROTO_PATH = “.\/password.proto”;<\/span><\/p>\n
keepCase: true,
longs: String,
enums: String,
defaults: true,
oneofs: true,
};<\/span><\/p>\n\n
var packageDef = protoLoader.loadSync(PROTO_PATH, loaderOptions);<\/span><\/p>\n
“passwords”: [
{ id: “153642”, password: “default1”, hashValue: “default”, saltValue: “default” },
{ id: “234654”, password: “default2”, hashValue: “default”, saltValue: “default” }]
};<\/span><\/p>\n
\/*our protobuf message(passwordMessage) for the RetrievePasswords was Empty. *\/
retrievePasswords: (passwordMessage, callback) => {
callback(null, dummyRecords);
},
addNewDetails: (passwordMessage, callback) => {
const passwordDetails = { …passwordMessage.request };
dummyRecords.passwords.push(passwordDetails);
callback(null, passwordDetails);
},
updatePasswordDetails: (passwordMessage, callback) => {
const detailsID = passwordMessage.request.id;
const targetDetails = dummyRecords.passwords.find(({ id }) => detailsID == id);
targetDetails.password = passwordMessage.request.password;
targetDetails.hashValue = passwordMessage.request.hashValue;
targetDetails.saltValue = passwordMessage.request.saltValue;
callback(null, targetDetails);
},
});<\/span><\/p>\n
“127.0.0.1:50051”,
grpc.ServerCredentials.createInsecure(),
(error, port) => {
console.log(“Server running at http:\/\/127.0.0.1:50051”);
ourServer.start();
}
);<\/span><\/p>\n
var protoLoader = require(“@grpc\/proto-loader”);
const PROTO_PATH = “.\/password.proto”;
const bcrypt = require(‘bcrypt’);
const options = {
keepCase: true,
longs: String,
enums: String,
defaults: true,
oneofs: true,
};
var grpcObj = protoLoader.loadSync(PROTO_PATH, options);
const PasswordService = grpc.loadPackageDefinition(grpcObj).PasswordService;<\/span><\/p>\n
“localhost:50051”,
grpc.credentials.createInsecure()
);<\/span><\/p>\n
\/\/implement your error logic here
console.log(passwords);
});<\/span><\/p>\n
let passwordToken = “5TgU76W&eRee!”;
let updatePasswordToken = “H7hG%$Yh33”
bcrypt.genSalt(saltRounds, function (error, salt) {
bcrypt.hash(passwordToken, salt, function (error, hash) {
clientStub.addNewDetails(
{
id: Date.now(),
password: passwordToken,
hashValue: hash,
saltValue: salt,
},
(error, passwordDetails) => {
\/\/implement your error logic here
console.log(passwordDetails);
}
);
});
});
bcrypt.genSalt(saltRounds, function (error, salt) {
\/\/implement your error logic here
bcrypt.hash(updatePasswordToken, salt, function (error, hash) {
\/\/implement your error logic here
clientStub.updatePasswordDetails(
{
\/*
This is one of the defaultIDs of our dummy object’s values.
You can change it to suit your needs
*\/
id: 153642,
password: updatePasswordToken,
hashValue: hash,
saltValue: salt,
},
(error, passwordDetails) => {
\/\/implement your error logic here
console.log(passwordDetails);
}
);
});
});<\/span><\/p>\n