URL Shortener
301 or 302 is a decision you make once and can never take back.
- Node.js
- HTTP
- JSON
About this project
Paste a long URL, get a short code, and visiting the code redirects. A small web page, a JSON API, and a hit counter per link. Built on Node's own http module — no Express, no database, no npm install.
The idea it is built around is the redirect status. A 302 says "go there for now" and the browser comes back to you every time. A 301 says "go there from now on, and stop asking" — and browsers cache that until the user clears their browsing data. Send a 301 and two things follow: you can never change where that link points for anyone who has already clicked it, and your hit counter stops counting, because the browser no longer asks. The default here is 302, and a --permanent flag lets you switch and watch the counter stop moving.
The second theme is that an open redirect is a real vulnerability. A redirector that will send visitors anywhere is a tool for other people's phishing, because the link starts with a domain the victim trusts. Targets are validated against a scheme whitelist before they are stored, including the case most people misread — the username before an @ sign.
What you will learn
- Choose between 301 and 302 knowing what each costs, and what each means to a search engine
- Prevent an open redirect by validating the target against a scheme whitelist
- Generate short codes with crypto.randomBytes, and know why a sequential id leaks
- Write a file atomically — temp file, fsync, rename — so a crash cannot corrupt it
- Build an HTTP server on Node's own modules, so you can see what a framework hides
Before you start
- JavaScript basics — functions, objects and callbacks
- Node 18 or newer. Nothing to install: built-in modules only.
New to Node.js? The free Node.js course covers everything this project assumes.
Academic integrity notice
These projects are provided for learning, experimentation and reference. Understand the code, modify it for your own requirements, and acknowledge external work according to your institution’s academic policies. Priodemy does not supply work to be submitted as your own.
Features
- 302 by default, 301 behind a flag, with the trade-off explained and demonstrable
- Target validation: http and https only, no credentials, no javascript: or data:
- Short codes from crypto.randomBytes over a 32-character look-alike-free alphabet
- Atomic saves — temp file, fsync, rename — so a crash cannot corrupt the store
- A JSON API to create, list, retarget and delete, plus a per-link hit counter
- Built-in modules only: node:http, node:fs, node:path, node:crypto
Technology stack
Track: Web Development · Level: Mini project
What is included
- server.js, store.js, shorten.js and a web page — commented throughout
- A README on 301 versus 302, open redirects, code generation and atomic writes
- Suggested extensions, including expiry, custom codes and a move to SQLite
Delivered as a 30 KB ZIP. SHA-256 published under Changelog so you can verify it.
System requirements
- Operating system
- Any
- Runtime
- Node 18 or newer. No dependencies, nothing to install.
Licence
Learn from it, change it, and use it in your own coursework and personal projects. Do not resell it or pass it off as your own original work.
- Personal and educational use
- Modifying the code however you like
- Using it as the basis of your own coursework, with honest acknowledgement
- Putting your modified version in a portfolio or on your own GitHub
- Reselling or redistributing the project, modified or not
- Presenting it as your own original work
- Commercial deployment — see the Commercial licence
Support window: 6 months from download.
Frequently asked
Why is 302 the default?
Because 301 is a promise you cannot take back. Browsers cache it aggressively, so you can never change that link's destination for anyone who has already clicked, and your click counter stops counting because the browser stops asking you. Run it with --permanent and watch the hit count stop moving.
What is an open redirect?
A redirector that will send a visitor anywhere. It is useful for phishing because the link begins with a domain the victim trusts. This project validates the target before storing it — http and https only, and no credentials before an @ sign, since https://priodemy.com@evil.example.com points at evil.example.com and almost nobody reads it that way.
Why not Express?
Because a student who has never written a server should meet the request and the response before meeting a framework that hides both. It also means there is nothing to install — you unzip it and run node server.js.
Can I put this on the internet?
Please do not. It has no accounts, no rate limiting and no abuse handling, and an open shortener will be found and used for phishing within days. That becomes your domain's reputation. It is a teaching project and it says so.
Changelog
- First release
SHA-2568e5899170cd5457a616ceb6c12404fbeb02cc2a862ccb2d8021f9a0a3fd6131a
You might also like
Free Personal Portfolio Website
A responsive portfolio in plain HTML and CSS — no framework, no build step.
- HTML
- CSS
Free Snake Game
The classic game in about 180 lines of plain JavaScript and a canvas.
- JavaScript
- Canvas
- HTML
Free Tic-Tac-Toe with AI
An opponent that plays perfectly, using minimax with alpha-beta pruning.
- JavaScript
- Minimax
- HTML
Free Typing Speed Test
A speed test that shows its own arithmetic, because WPM is a definition rather than a measurement.
- JavaScript
- CSS
- HTML