Hackathon Starter
Live Demo: Link
Jump to What's new?
A boilerplate for Node.js web applications.
If you have attended any hackathons in the past, then you know how much time it takes to get a project started: decide on what to build, pick a programming language, pick a web framework, pick a CSS framework. A while later, you might have an initial project up on GitHub, and only then can other team members start contributing. Or how about doing something as simple as Sign in with Facebook authentication? You can spend hours on it if you are not familiar with how OAuth 2.0 works.
When I started this project, my primary focus was on simplicity and ease of use. I also tried to make it as generic and reusable as possible to cover most use cases of hackathon web apps, without being too specific. In the worst case, you can use this as a learning guide for your projects, if for example you are only interested in Sign in with Google authentication and nothing else.
Testimonialsβ
βNice! That README alone is already gold!β
β Adrian Le Bas
βAwesome. Simply awesome.β
β Steven Rueter
βI'm using it for a year now and many projects, it's an awesome boilerplate and the project is well maintained!β
β Kevin Granger
βSmall world with Sahat's project. We were using his hackathon starter for our hackathon this past weekend and got some prizes. Really handy repo!β
β Interview candidate for one of the companies I used to work with.
Modern Theme
Flatly Bootstrap Theme
API Examples
Table of Contentsβ
- Features
- Prerequisites
- Getting Started
- Obtaining API Keys
- Project Structure
- List of Packages
- Useful Tools and Resources
- Recommended Design Resources
- Recommended Node.js Libraries
- Recommended Client-side Libraries
- Pro Tips
- FAQ
- How It Works
- Cheatsheets
- Deployment
- Docker
- Production
- Changelog
- Contributing
- License
Featuresβ
- Login
- Local Authentication using Email and Password
- OAuth 2.0 Authentication: Sign in with Google, Facebook, X (Twitter), LinkedIn, Twitch, Github, Snapchat
- User Profile and Account Management
- Gravatar
- Profile Details
- Change Password
- Forgot Password
- Reset Password
- Verify Email
- Link multiple OAuth strategies to one account
- Delete Account
- Contact Form (powered by SMTP via Sendgrid, Mailgun, AWS SES, etc.)
- File upload
- API Examples
- Facebook, Foursquare, Tumblr, Pinterest, Github, Steam, Quickbooks, Paypal, Stripe, Twilio (text messaging), Lob (USPS Mail), HERE Maps, Google Maps, Google Drive, Google Sheets, Alpha Vantage (stocks and finance info) with ChartJS, Last.fm, New York Times, Web Scraping,
- Flash notifications
-
- reCaPTCHA and rate limit protection
- CSRF protection
- MVC Project Structure
- Node.js clusters support
- HTTPS Proxy support (via ngrok, Cloudflare, etc.)
- Sass stylesheets (auto-compiled via middleware)
- Bootstrap 5
- "Go to production" checklist
Prerequisitesβ
-
MongoDB (local install OR hosted)
- Local Install: MongoDB
- Hosted: No need to install, see the MongoDB Atlas section
-
Command Line Tools
-
Β Mac OS X: Xcode (or OS X 10.9+:
xcode-select --install
) -
Β Windows: Visual Studio Code + Windows Subsystem for Linux - Ubuntu OR Visual Studio
-
Β Ubuntu / Β Linux Mint:
sudo apt-get install build-essential
-
Β Fedora:
sudo dnf groupinstall "Development Tools"
-
Β OpenSUSE:
sudo zypper install --type pattern devel_basis
Note: If you are new to Node or Express, you may find Node.js & Express From Scratch series helpful for learning the basics of Node and Express. Alternatively, here is another great tutorial for complete beginners - Getting Started With Node.js, Express, MongoDB.
Getting Startedβ
Step 1: The easiest way to get started is to clone the repository:
# Get the latest snapshot
git clone https://github.com/sahat/hackathon-starter.git myproject
# Change directory
cd myproject
# Install NPM dependencies
npm install
# Then simply start your app
node app.js
Note: I highly recommend installing Nodemon. It watches for any changes in your node.js app and automatically restarts the server. Once installed, instead of node app.js
use nodemon app.js
. It will
save you a lot of time in the long run, because you won't need to manually restart the server each time you make a small change in code. To install, run sudo npm install -g nodemon
.
Step 2: Obtain API Keys and change configs if needed After completing step 1 and locally installing MongoDB, you should be able to access the application through a web browser and use local user accounts. However, certain functions like API integrations may not function correctly until you obtain specific keys from service providers. The keys provided in the project serve as placeholders, and you can retain them for features you are not currently utilizing. To incorporate the acquired keys into the application, you have two options:
- Set environment variables in your console session: Alternatively, you can set the keys as environment variables directly through the command prompt. For instance, in bash, you can use the
export
command like this:export FACEBOOK_SECRET=xxxxxx
. This method is considered a better practice as it reduces the risk of accidentally including your secrets in a code repository. - Replace the keys in the
.env.example
file: Open the.env.example
file and update the placeholder keys with the newly acquired ones. This method has the risk of accidental checking-in of your secrets to code repos.
What to get and configure:
-
SMTP
- For user workflows for reset password and verify email
- For contact form processing
-
reCAPTCHA
- For contact form submission
-
OAuth for social logins (Sign in with / Login with)
- Depending on your application need, obtain keys from Google, Facebook, X (Twitter), LinkedIn, Twitch, GitHub, Snapchat. You don't have to obtain valid keys for any provider that you don't need. Just remove the buttons and links in the login and account pug views before your demo.
-
API keys for service providers in the API Examples if you are planning to use them.
-
MongoDB Atlas
- If you are using MongoDB Atlas instead of a local db, set the MONGODB_URI to your db URI (including your db user/password).
-
Email address
- Set SITE_CONTACT_EMAIL as your incoming email address for messages sent to you thru the contact form.
- Set TRANSACTION_EMAIL as the "From" address for emails sent to users thru the lost password or email verification emails to users. You may set this to the same address as SITE_CONTACT_EMAIL.
-
ngrok and HTTPS If you want to use some API that needs HTTPS to work (for example Pinterest or Facebook), you will need to download ngrok. Start ngrok, set your BASE_URL to the forwarding address (i.e
https://3ccb-1234-abcd.ngrok-free.app
), and use the forwarding address to access your application. If you are using a proxy like ngrok, you may get a CSRF mismatch error if you try to access the app athttp://localhost:8080
instead of the https://...ngrok-free.app address.After installing or downloading the standalone ngrok client you can start ngrok to intercept the data exchanged on port 8080 with
./ngrok http 8080
in Linux orngrok http 8080
in Windows.
Step 3: Develop your application and customize the experience
- Check out How It Works
Step 4: Optional - deploy to production See:
Obtaining API Keys
You will need to obtain appropriate credentials (Client ID, Client Secret, API Key, or Username & Password) for API and service provides which you need. See Step 2 in the Getting started section for more info.
SMTPβ
Obtain SMTP credentials from a provider for transactional emails. Set the SMTP_USER, SMTP_PASSWORD, and SMTP_HOST environment variables accordingly. When picking the smtp host, keep in mind that the app is configured to use secure SMTP transmissions over port 465 out of the box. You have the flexibility to select any provider that suits your needs or take advantage of one of the following providers, each offering a free tier for your convenience.
Provider | Free Tier | Website |
---|---|---|
SendGrid | 100 emails/day for free | https://sendgrid.com |
SMTP2Go | 1000 emails/month for free | https://www.smtp2go.com |
Brevo | 300 emails/day for free | https://www.brevo.com |
- Visit Google reCAPTCHA Admin Console
- Enter your application's name as the Label
- Choose reCAPTCHA v2, "I'm not a robot" Checkbox
- Enter localhost as the domain. You can have other domains added in addition to localhost
- Accept the terms and submit the form
- Copy the Site Key and the Secret key into
.env
. These keys will be accessible under Settings, reCAPTCHA keys drop down if you need them again later
- Visit Google Cloud Console
- Click on the Create Project button
- Enter Project Name, then click on Create button
- Then click on APIs & auth in the sidebar and select API tab
- Click on Google+ API under Social APIs, then click Enable API
- Click on Google Drive API under G Suite, then click Enable API
- Click on Google Sheets API under G Suite, then click Enable API
- Next, under APIs & auth in the sidebar click on Credentials tab
- Click on Create new Client ID button
- Select Web Application and click on Configure Consent Screen
- Fill out the required fields then click on Save
- In the Create Client ID modal dialog:
- Application Type: Web Application
- Authorized Javascript origins: set to your BASE_URL value (i.e.
http://localhost:8080
, etc) - Authorized redirect URI: set to your BASE_URL value followed by /auth/google/callback (i.e.
http://localhost:8080/auth/google/callback
) - Click on Create Client ID button
- Copy and paste Client ID and Client secret keys into
.env
- Visit Snap Kit Developer Portal
- Click on the + button to create an app
- Enter a name for your app
- Enable the scopes that you will want to use in your app
- Click on the Continue button
- Find the Kits section and make sure that Login Kit is enabled
- Find the Redirect URLs section, click the + Add button, and enter your BASE_URL value followed by /auth/snapchat/callback (i.e.
http://localhost:8080/auth/snapchat/callback
) - Find the Development Environment section. Click the Generate button next to the Confidential OAuth2 Client heading within it.
- Copy and paste the generated Private Key and OAuth2 Client ID keys into
.env
- Note: OAuth2 Client ID is SNAPCHAT_ID, Private Key is SNAPCHAT_SECRET in
.env
- To prepare the app for submission, fill out the rest of the required fields: Category, Description, Privacy Policy Url, and App Icon
- Visit Facebook Developers
- Click My Apps, then select *Add a New App from the dropdown menu
- Enter a new name for your app
- Click on the Create App ID button
- Find the Facebook Login Product and click on Facebook Login
- Instead of going through their Quickstart, click on Settings for your app in the top left corner
- Copy and paste App ID and App Secret keys into
.env
- Note: App ID is FACEBOOK_ID, App Secret is FACEBOOK_SECRET in
.env
- Enter
localhost
under App Domains - Choose a Category that best describes your app
- Click on + Add Platform and select Website
- Enter your BASE_URL value (i.e.
http://localhost:8080
, etc) under Site URL - Click on the Settings tab in the left nav under Facebook Login
- Enter your BASE_URL value followed by /auth/facebook/callback (i.e.
http://localhost:8080/auth/facebook/callback
) under Valid OAuth redirect URIs
Note: After a successful sign-in with Facebook, a user will be redirected back to the home page with appended hash #_=_
in the URL. It is not a bug. See this Stack Overflow discussion for ways to handle it.
- Go to Account Settings
- Select Developer settings from the sidebar
- Then click on OAuth Apps and then on Register new application
- Enter Application Name and Homepage URL. Enter your BASE_URL value (i.e.
http://localhost:8080
, etc) as the homepage URL. - For Authorization Callback URL: your BASE_URL value followed by /auth/github/callback (i.e.
http://localhost:8080/auth/github/callback
) - Click Register application
- Now copy and paste Client ID and Client Secret keys into
.env
file
- Sign in at https://apps.twitter.com
- Click Create a new application
- Enter your application name, website and description. Set the website as your BASE_URL value (i.e.
http://localhost:8080
, etc). - For Callback URL: your BASE_URL value followed by /auth/twitter/callback (i.e.
http://localhost:8080/auth/twitter/callback
) - Go to Settings tab
- Under Application Type select Read and Write access
- Check the box Allow this application to be used to Sign in with Twitter
- Click Update this Twitter's applications settings
- Copy and paste Consumer Key and Consumer Secret keys into
.env
file
- Sign in at LinkedIn Developer Network
- From the account name dropdown menu select API Keys
- It may ask you to sign in once again
- Click + Add New Application button
- Fill out all the required fields
- OAuth 2.0 Redirect URLs: your BASE_URL value followed by /auth/linkedin/callback (i.e.
http://localhost:8080/auth/linkedin/callback
) - JavaScript API Domains: your BASE_URL value (i.e.
http://localhost:8080
, etc). - For Default Application Permissions make sure at least the following is checked:
r_basicprofile
- Finish by clicking Add Application button
- Copy and paste API Key and Secret Key keys into
.env
file - API Key is your clientID
- Secret Key is your clientSecret
- Sign up or log into your dashboard
- Click on your profile and click on Account Settings
- Then click on API Keys
- Copy the Secret Key. and add this into
.env
file
- Visit PayPal Developer
- Log in to your PayPal account
- Click Applications > Create App in the navigation bar
- Enter Application Name, then click Create app
- Copy and paste Client ID and Secret keys into
.env
file - App ID is client_id, App Secret is client_secret
- Change host to api.paypal.com if you want to test against production and use the live credentials
- Go to Foursquare for Developers
- Click on My Apps in the top menu
- Click the Create A New App button
- Enter App Name, Welcome page url,
- For Redirect URI: your BASE_URL value followed by /auth/foursquare/callback (i.e.
http://localhost:8080/auth/foursquare/callback
) - Click Save Changes
- Copy and paste Client ID and Client Secret keys into
.env
file
- Go to http://www.tumblr.com/oauth/apps
- Once signed in, click +Register application
- Fill in all the details
- For Default Callback URL: your BASE_URL value followed by /auth/tumblr/callback (i.e.
http://localhost:8080/auth/tumblr/callback
) - Click βRegister
- Copy and paste OAuth consumer key and OAuth consumer secret keys into
.env
file
- Go to http://steamcommunity.com/dev/apikey
- Sign in with your existing Steam account
- Enter your Domain Name based on your BASE_URL, then and click Register
- Copy and paste Key into
.env
file
- Visit the Twitch developer dashboard
- If prompted, authorize the dashboard to access your twitch account
- In the Console, click on Register Your Application
- Enter the name of your application
- Use OAuth Redirect URLs enter your BASE_URL value followed by /auth/twitch/callback (i.e.
http://localhost:8080/auth/twitch/callback
) - Set Category to Website Integration and press the Create button
- After the application has been created, click on the Manage button
- Copy and paste Client ID into
.env
- If there is no Client Secret displayed, click on the New Secret button and then copy and paste the Client secret into
.env
- Go to https://developer.here.com
- Sign up and create a Freemium project
- Create JAVASCRIPT/REST credentials. Copy and paste the APP_ID and APP into
.env
file. - Note that these credentials are available on the client-side, and you need to create a domain whitelist for your app credentials when you are publicly launching the app.
- Go to https://www.twilio.com/try-twilio
- Sign up for an account.
- Once logged into the dashboard, expand the link 'show api credentials'
- Copy your Account Sid and Auth Token
- Go to https://developer.intuit.com/app/developer/qbo/docs/get-started
- Use the Sign Up option in the upper right corner of the screen (navbar) to get a free developer account and a sandbox company.
- Create a new app by going to your Dashboard using the My Apps option in the top nav bar or by going to https://developer.intuit.com/app/developer/myapps
- In your App, under Development, Keys & OAuth (right nav), find the Client ID and Client Secret for your
.env
file
Project Structureβ
Name | Description |
---|---|
config/passport.js | Passport Local and OAuth strategies, plus login middleware. |
controllers/api.js | Controller for /api route and all api examples. |
controllers/contact.js | Controller for contact form. |
controllers/home.js | Controller for home page (index). |
controllers/user.js | Controller for user account management. |
models/User.js | Mongoose schema and model for User. |
public/ | Static assets (fonts, css, js, img). |
public/js/application.js | Specify client-side JavaScript dependencies. |
public/js/app.js | Place your client-side JavaScript here. |
public/css/main.scss | Main stylesheet for your app. |
views/account/ | Templates for login, password reset, signup, profile. |
views/api/ | Templates for API Examples. |
views/partials/flash.pug | Error, info and success flash notifications. |
views/partials/header.pug | Navbar partial template. |
views/partials/footer.pug | Footer partial template. |
views/layout.pug | Base template. |
views/home.pug | Home page template. |
.dockerignore | Folder and files ignored by docker usage. |
.env.example | Your API keys, tokens, passwords and database URI. |
.eslintrc | Rules for eslint linter. |
.gitignore | Folder and files ignored by git. |
app.js | The main application file. |
docker-compose.yml | Docker compose configuration file. |
Dockerfile | Docker configuration file. |
package.json | NPM dependencies. |
package-lock.json | Contains exact versions of NPM dependencies in package.json. |
Note: There is no preference for how you name or structure your views.
You could place all your templates in a top-level views
directory without
having a nested folder structure if that makes things easier for you.
Just don't forget to update extends ../layout
and corresponding
res.render()
paths in controllers.
List of Packagesβ
Package | Description |
---|---|
@fortawesome/fontawesome-free | Symbol and Icon library. |
@googleapis/drive | Google Drive API integration library. |
@googleapis/sheets | Google Sheets API integration library. |
@ladjs/bootstrap-social | Social buttons library. |
@lob/lob-typescript-sdk | Lob (USPS mailing / physical mailing service) library. |
@node-rs/bcrypt | Library for hashing and salting user passwords. |
@octokit/rest | GitHub API library. |
@passport-js/passport-twitter | X (Twitter) login support (OAuth 2). |
@popperjs/core | Frontend js library for poppers and tooltips. |
axios | HTTP client. |
body-parser | Node.js body parsing middleware. |
bootstrap | CSS Framework. |
chai | BDD/TDD assertion library. |
cheerio | Scrape web pages using jQuery-style syntax. |
compression | Node.js compression middleware. |
connect-mongo | MongoDB session store for Express. |
dotenv | Loads environment variables from .env file. |
errorhandler | Development-only error handler middleware. |
eslint | Linter JavaScript. |
eslint-config-airbnb-base | Configuration eslint by airbnb. |
eslint-plugin-chai-friendly | Makes eslint friendly towards Chai.js 'expect' and 'should' statements. |
eslint-plugin-import | ESLint plugin with rules that help validate proper imports. |
express | Node.js web framework. |
express-flash | Provides flash messages for Express. |
express-rate-limit | Rate limiting middleware for abuse protection. |
express-session | Simple session middleware for Express. |
husky | Git hook manager to automate tasks with git. |
jquery | Front-end JS library to interact with HTML elements. |
lastfm | Last.fm API library. |
lint-stage | Utility to lint files staged by git. |
lob | Lob API library. |
lodash | A utility library for working with arrays, numbers, objects, strings. |
lusca | CSRF middleware. |
mailchecker | Verifies that an email address is valid and not a disposable address. |
mocha | Test framework. |
moment | Parse, validate, compute dates and times. |
mongodbMemoryServer | MongoDB in memory (for running tests without a running db). |
mongoose | MongoDB ODM. |
morgan | HTTP request logger middleware for node.js. |
multer | Node.js middleware for handling multipart/form-data . |
nodemailer | Node.js library for sending emails. |
nyc | Coverage test. |
passport | Simple and elegant authentication library for node.js. |
passport-facebook | Sign-in with Facebook plugin. |
passport-github2 | Sign-in with GitHub plugin. |
passport-google-oauth | Sign-in with Google plugin. |
passport-linkedin-oauth2 | Sign-in with LinkedIn plugin. |
passport-local | Sign-in with Username and Password plugin. |
passport-oauth | Allows you to set up your own OAuth 1.0a and OAuth 2.0 strategies. |
passport-oauth2-refresh | A library to refresh OAuth 2.0 access tokens using refresh tokens. |
passport-snapchat | Sign-in with Snapchat plugin. |
passport-steam-openid | OpenID 2.0 Steam plugin. |
patch-package | Fix broken node modules ahead of fixes by maintainers. |
paypal-rest-sdk | PayPal APIs library. |
pug | Template engine for Express. |
sass | Sass compiler to generate CSS with superpowers |
sinon | Test spies, stubs and mocks for JavaScript. |
stripe | Offical Stripe API library. |
supertest | HTTP assertion library. |
twilio | Twilio API library. |
twitch-passport | Sign-in with Twitch plugin. |
validator | A library of string validators and sanitizers. |
Useful Tools and Resourcesβ
- JavaScripting - The Database of JavaScript Libraries
- HTML to Pug converter - HTML to PUG is a free online converter helping you to convert HTML files to pug syntax in real-time.
- JavascriptOO - A directory of JavaScript libraries with examples, CDN links, statistics, and videos.
- Favicon Generator - Generate favicons for PC, Android, iOS, Windows 8.
Recommended Design Resourcesβ
- Code Guide - Standards for developing flexible, durable, and sustainable HTML and CSS.
- Bootsnipp - Code snippets for Bootstrap.
- Bootstrap Zero - Free Bootstrap templates themes.
- Google Bootstrap - Google-styled theme for Bootstrap.
- Font Awesome Icons - It's already part of the Hackathon Starter, so use this page as a reference.
- Colors - A nicer color palette for the web.
- Creative Button Styles - awesome button styles.
- Creative Link Effects - Beautiful link effects in CSS.
- Medium Scroll Effect - Fade in/out header background image as you scroll.
- GeoPattern - SVG background pattern generator.
- Trianglify - SVG low-poly background pattern generator.
Recommended Node.js Librariesβ
- Nodemon - Automatically restart Node.js server on code changes.
- geoip-lite - Geolocation coordinates from IP address.
- Filesize.js - Pretty file sizes, e.g.
filesize(265318); // "265.32 kB"
. - Numeral.js - Library for formatting and manipulating numbers.
- sharp - Node.js module for resizing JPEG, PNG, WebP and TIFF images.
Recommended Client-side Librariesβ
- Framework7 - Full Featured HTML Framework For Building iOS7 Apps.
- InstantClick - Makes your pages load instantly by pre-loading them on mouse hover.
- NProgress.js - Slim progress bars like on YouTube and Medium.
- Hover - Awesome CSS3 animations on mouse hover.
- Magnific Popup - Responsive jQuery Lightbox Plugin.
- Offline.js - Detect when user's internet connection goes offline.
- Alertify.js - Sweet looking alerts and browser dialogs.
- selectize.js - Styleable select elements and input tags.
- drop.js - Powerful Javascript and CSS library for creating dropdowns and other floating displays.
- scrollReveal.js - Declarative on-scroll reveal animations.
Pro Tipsβ
- Need to find a specific object inside an Array? Use _.find function from Lodash. For example, this is how you would retrieve an X (Twitter) token from database:
var token = _.find(req.user.tokens, { kind: 'twitter' });
, where 1st parameter is an array, and a 2nd parameter is an object to search for.
FAQβ
Why do I get 403 Error: Forbidden
when submitting a form?β
You need to add the following hidden input element to your form. This has been added in the pull request #40 as part of the CSRF protection.
input(type='hidden', name='_csrf', value=_csrf)
Note: It is now possible to whitelist certain URLs. In other words, you can specify a list of routes that should bypass the CSRF verification check.
Note 2: To whitelist dynamic URLs use regular expression tests inside the CSRF middleware to see if req.originalUrl
matches your desired pattern.
I am getting MongoDB Connection Error, how do I fix it?β
That's a custom error message defined in app.js
to indicate that there was a problem connecting to MongoDB:
mongoose.connection.on('error', (err) => {
console.error(err);
console.log('%s MongoDB connection error. Please make sure MongoDB is running.', chalk.red('β'));
process.exit();
});
You need to have a MongoDB server running before launching app.js
. You can download MongoDB here, or install it via a package manager.
Windows users, read Install MongoDB on Windows.
Tip: If you are always connected to the internet, you could just use MongoDB Atlas instead of downloading and installing MongoDB locally. You will only need to update database credentials in .env
file.
I get an error when I deploy my app, why?β
Chances are you haven't changed the Database URI in .env
. If MONGODB
is set to localhost
, it will only work on your machine as long as MongoDB is running. When you deploy to Render, OpenShift, or some other provider, you will not have MongoDB running on localhost
. You need to create an account with MongoDB Atlas, then create a free tier database.
See Deployment for more information on how to set up an account and a new database step-by-step with MongoDB Atlas.
Why do you have all routes defined in app.js?β
For the sake of simplicity. While there might be a better approach, such as passing app
context to each controller as outlined in this blog, I find such a style to be confusing for beginners. It took me a long time to grasp the concept of exports
and module.exports
, let alone having a global app
reference in other files. Tha to me is backward thinking.
The app.js
is the "heart of the app", it should be the one referencing models, routes, controllers, etc.
When working solo on small projects, I prefer to have everything inside app.js
as is the case with this REST API server.
How It Works (mini guides)β
This section is intended for giving you a detailed explanation of how a particular functionality works. Maybe you are just curious about how it works, or perhaps you are lost and confused while reading the code, I hope it provides some guidance to you.