Will WAB work with newer version of Node.js?

[ThomasColson]

As far as I can tell, WAB 2.0 ships with Node.js version 0.10.33.0. Looks like the latest Node version is 4.4.4. Has anyone tried WAB with that version?

[RobertScheitlin__GISP · Accepted solution]

Thomas,

  I am running it using 4.2.4 so I would say you will be OK. FYI unless you explicitly change the startup.bat file, wab will always use the packaged version of nodeJS anyway. Here is the change I made to the startup.bat to use my local nodeJS.

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: If you want to start nodejs manually with additional parameters, run           ::

:: node_x86.exe/node_x64.exe from server directory instead of launching this      ::

:: script file.                                              ::

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

@ECHO OFF

SETLOCAL EnableDelayedExpansion

TITLE Web AppBuilder for ArcGIS

SET serverPath=server

SET serverjsFile=server.js

SET port=3344

SET wabVirtualPath=webappbuilder

SET portTaken=0

IF DEFINED USERDNSDOMAIN (SET FQDN=%COMPUTERNAME%.%USERDNSDOMAIN%) ELSE (SET FQDN=%COMPUTERNAME%)

rem IF DEFINED PROGRAMFILES(X86) (SET nodeFile=node_x64.exe) ELSE (SET nodeFile=node_x86.exe)

SET nodeFile="C:\Program Files\nodejs\node.exe"

[ThomasColson]

Looks like WAB runs perfectly happy with Node 6.2.0 as well.

[TimHayes1]

What are the advantages if we use the latest version of Node.js vs the one that shipped with WAB DE 2.0?

Specifically, what UI or WAB behavior changes will occur? will these make it more efficient to the end user and/or the developer?

[RobertScheitlin__GISP]

Tim,

  No advantage that I am aware of. this is just for those developers that are developing against nodeJS already and thus have a version on their machine.

[ThomasColson]

There are a number of vulnerability issues with older versions of Node.js that we really had no choice but to go to 6.2.0, and quickly. This has been logged with support as BUG-000096647.

[RobertScheitlin__GISP]

Thomas,

  I am curious nodeJS is used for the Web AppBuilder builder portion and not the viewer portion. So how would these vulnerabilities matter once the app is deployed to your web server?

[ThomasColson]

Unable to share a lot of details, but running the "un-secure" version of Node.js on workstations that are developing the apps triggered some alarms. The way Node is run with WAB developer it opens a lot of http/https sockets that came to the attention of a scanner. So the issue is not with the app that WAB produces, but with WAB itself.

[JoshuaBixby]

I don't work with WAB, so I am not sure if what I am about to suggest will work.  Since these workstations are being used for development, could you install a loopback adapter in the OS and then bind to that so WAB can bind to a network interface, just not one attached to any networks?

[ThomasColson]

The problem is, WAB has to connect to PTL or AGOL to work, so trunking the WAB traffic off the NIC to loopback wouldn't work. Regardless, we had two non-negotiable, not-subject-to-any-discussion choices: remove WAB, or, fix the Node vulnerability. Good thing there's a new version of Node that has all of the holes patched. Otherwise WAB would be gone and I'd be learning java script....