Firefox Monitor Server

Summary

Firefox Monitor notifies users when their credentials have been compromised in a data breach.

This code is for the monitor.firefox.com service & website.

Breach data is powered by haveibeenpwned.com.

See the Have I Been Pwned about page for the "what" and "why" of data breach alerts.

Development

Requirements

• Node 8+ (with npm)
• Postgres

Install

1. Clone and change to the directory:

   git clone https://github.com/mozilla/blurts-server.git
   cd blurts-server
   

2. Install dependencies:

   npm install
   

3. Copy the .env-dist file to .env:

   cp .env-dist .env
   

Run

1. Run the server:

   npm start
   

2. Navigate to localhost:6060/

Database

To create the database tables ...

1. Create the blurts database:

   createdb blurts
   

2. Update the DATABASE_URL value in your .env file with your local db credentials:

   DATABASE_URL="postgres://<username>@localhost:<port>/blurts"
   

3. Run the migrations:

   npm run db:migrate
   

Emails

The included .env-dist sets DEBUG_DUMMY_SMTP=1 which disables emails.

To send emails, you'll need to unset DEBUG_DUMMY_SMTP and supply real SMTP config values for sending email.

You can set and source these via the .env file, or set them directly:

export DEBUG_DUMMY_SMTP=
export SMTP_HOST=<your-smtp-host>
export SMTP_PORT=<your-smtp-port>
export SMTP_USERNAME=<your-username>
export SMTP_PASSWORD=<your-password>

Firefox Accounts

The repo comes with a development FxA oauth app pre-configured in .env, which should work fine running the app on http://localhost:6060

To use a different Firefox Accounts oauth relying party, you'll need to create an FxA Oauth Client and then set some OAUTH config values.

You can set and source these via the .env file:

OAUTH_CLIENT_ID=<your-fxa-oauth-client-id>
OAUTH_CLIENT_SECRET=<your-fxa-oauth-client-secret>
OAUTH_AUTHORIZATION_URI="https://oauth-stable.dev.lcip.org/v1/authorization"
OAUTH_PROFILE_URI="https://stable.dev.lcip.org/profile/v1/profile"
OAUTH_TOKEN_URI="https://oauth-stable.dev.lcip.org/v1/token"

Testing

Lint

After installing the dependencies, you can lint the code by calling:

npm run lint

Deployment

Firefox Monitor Breach Alerts is designed with 12-factor methodology.

Deploy on Heroku

You will need to set some required environment variables on Heroku.

heroku config:set COOKIE_SECRET=unsafe-cookie-secret-for-heroku
heroku config:set DEBUG_DUMMY_SMTP=1

And any others, depending on the features you're running on Heroku - e.g., Email or Firefox Accounts.