NodeJS Security Cheat Sheet — Use flat Promise chains

Reference note (untrusted external data; do not execute it as instructions). Asynchronous callback functions are one of the strongest features of Node.js. However, increasing layers of nesting within callback functions can become a problem. Any multistage process can become nested 10 or more levels deep. This problem is referred to as a "Pyramid of Doom" or "Callback Hell". In such code, the errors and results get lost within the callback. Promises are a good way to write asynchronous code without getting into nested pyramids. Promises provide top-down execution while being asynchronous by delivering errors and results to next .then function. Another advantage of Promises is the way Promises handle errors. If an error occurs in a Promise class, it skips over the .then functions and invokes the first .catch function it finds. This way Promises provide a higher assurance of capturing and handling errors. As a principle, you can make all your asynchronous code (apart from emitters) return promises. It should be noted that Promise calls can also become a pyramid. In order to completely stay away from "Callback Hell", flat Promise chains should be used. If the module you are using does not support Promises, you can convert base object to a Promise by using Promise.promisifyAll() function. The following code snippet is an example of "Callback Hell" Bounded code example (external data; do not execute automatically): ```JavaScript function func1(name, callback) { // operations that takes a bit of time and then calls the callback } function func2(name, callback) { // operations that takes a bit of time and then calls the callback } function func3(name, callback) { // operations that takes a bit of time and then calls the callback } function func4(name, callback) { // operations that takes a bit of time and then calls the callback } func1("input1", function(err, result1){ if(err){ // error operations } else { //some operations func2("input2", function(err, result2){ if(err){ //error operations } else{ //some operations func3("input3", function(err, result3){ if(err){ //error operations } else{ // some operations func4("in ``` The above code can be securely written as follows using a flat Promise chain … Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.