CODEWITHSUNDEEP
javascriptnode.js
georgesamper
georgesamper

Reputation: 5179

Nodejs global variables and modules

Are there any security issuses or something with using global variables and assignig modules to global variables in nodejs?

example:

client = new Client();

Without the var statement, so i can use it everywhere?

Upvotes: 1

Views: 3586

Answers (3)

JR.
JR.

Reputation: 1431

I've been using Node for a couple of years and I had the same "problem" you have and is frustrating. Nevertheless I can give you the solution I reached and it works for me.

Node doesn't allows global variables in the way you ask since variables defined as global in a module are global only for that module. But exists a GLOBAL object that ban be used for what you need.

Global variables are a bad idea in general (always), but having a global cache of useful functions in it's own namespace is not a crime at all since it will not override anything and lets you use it along your code. So I'll tell you what I do to share functions and objects between modules and keep source organized (that's important for me at least!):

1st Create a resource file where you place all important functions and objects you want to share across your code. I call mine "R.js", R from Resources

2st Define the "R" object that will store all functions and objects and assign it to node's GLOBAL object:

var R = {};
GLOBAL.R = R; // Adds resource module to global

3rd For sake of simplicity and avoid extra requires all arround the code, I do all needed requires inside R.js. After that you only need to use them with R.require_variable.function_or_property

// All needed requires
R.fs       = require('fs');
R.net      = require('net');
R.http     = require('http');
R.dbClient = require('mysql').Client;
...

4th Create the shared functions, variables and objects you like inside the R object

5th Where needed arround your code, require the R.js file and access to it's member by using the R object

R.<property_or_function>

2 warning notes.

  • Remember to always call shared functions or user shared objects placind "R." in front of it
  • Althought you can assign new functions, objects and properties to R object anywhere this can lead to the same inconsistencies you would have with global variables if you don't plan it in advance - i.e. you call a shared function before assigning it to R - so as a methodology, create everything in the R.js file instead of doing it all arround your code. This way all shared things will be in R.js and that is the only place to look for shared code.

Upvotes: 1

alessioalex
alessioalex

Reputation: 63683

It's not that it's a security problem, it's considered bad practice though and it can lead to other problems such as trying to override a Node.js global variable.

Try not to pollute the global namespace and if you really really need global variables, just use one with sub-objects.

Upvotes: 6

hanktard
hanktard

Reputation: 71

I don't think there are security issues per se, but you will be polluting the global namespace. As your project grows (especially with more than one programmer) the risk of conflicts gets bigger. And what if you later on add a third party library to your project that has a variable named 'client'?

Upvotes: 2

Related Questions