Re:Web Developer Security Checklist
by partycoder on Tuesday May 16, 2017 @01:56PM
(#14351728)
It's not a problem with the garbage collector, just how the objects are referenced. Basically you need to ensure the request reaches a terminal state where you either close the connection (ServerResponse.end) or send a response (ServerResponse.send and similar). All the cleanup happens after you do that.
Re:Web Developer Security Checklist
by slackingoff2017 on Tuesday May 16, 2017 @07:24PM
(#14354258)
Is there not an OnDispose or some kind of hook to detect when requests can end? To end a request in every framework I've used you just return from your code back to the framework. You shouldn't have to worry about a framework object like request state.
Re:Web Developer Security Checklist
by partycoder on Wednesday May 17, 2017 @03:16AM
(#14356282)
There are ways to detect this, but since express declares itself as an "minimalistic, non-opinionated framework" it's up to you to do it and do it correctly, or have correctly implemented logic that does not run into this issue.
I've used many web stacks over the years and not a single one defaults to blowing up like that. They all follow proper modularization... The framework cleans up objects that the framework creates, you deal with yours.
In any other framework forgetting to end the request would result in the request automatically ending when your code finishes. This includes Vert.x and Undertow which are just as asynchronous as Node(but also multithreaded).
Also how the hell does that leak memory? Is JS reference counting that bad? I've done some really stupid things in Java and C# but never leaked memory enough that it mattered.