Secure (AES) file system storage component for Loopback / IBM API ORM

Usage no npm install needed!

<script type="module">
  import loopbackSecureStorage from 'https://cdn.skypack.dev/loopback-secure-storage';



Secure (AES) file system storage component for Express & Loopback / IBM API ORM


Version 2

Work has been done on the library, thereby is it not compatible with the previous versions (last one was 1.1.7). It is now used as a singleton and not a stateless module anymore.

Your current configuration json file is still compatible, but now you can specify the allowed extensions (combined with the mime type check).

You can also setup the configuration as a js object when calling the initialisation method of the module instance.

For everyone to be satisfied, the module's methods can be used as promises or with callback (excepted for the servers methods).


  • AES encryption / decryption
  • HTTP upload / download support methods (express-compatible)
  • 128bits key support (generate / use / check)
  • compatible with Loopback's storage component (usage, config)
  • can be used as an express method


Because code is always better than a Markdown file, an example is available here. Feel free to clone and tweak it!


In your own project, run npm i loopback-secure-storage and you're good to go.


The configuration object expected by the module is the following one:

const config = {
    name: "secureStorageConfig",            // Container name

    root: `./storage/container`,            // Container root directory (project root reference)

    nameMakeUnique: true,                   // set to true to prevent name collisions for the uploaded files

    maxFileSize: SecureStorage.asMiB(50),   // maximum byte size: as KiB, GiB, or a simple integer
                                            // (optional, omit key or set as 0 to skip size verification)

    allowedContentTypes: [                  // optional mime type filter if key is set
    allowedExtensions: [                    // optional extension filter if key is set
    sysKey: "your-16-bytes-aes-key"         // the AES key to use

As object, as config file?

You can pass this configuration directly to the init() method, or save it under a json file (like other json config files used in Loopback).

Add the file in your server directory, named storage.NODE_ENV.json:

    "secureStorageConfig": {
        "name": "secureStorageConfig",      // Loopback container name
        "root": ...

Note: You do not have to create the "root" directory, if it does not exists, then the module will do the job when the app starts.


const SecureStorage = require('loopback-secure-storage');

// using a configuration object

// or... using a configuration file

// write and read a file
SecureStorage.writeFile('myFile.txt', 'data to be written')
    .then(() => SecureStorage.readFile('myFile.txt'))
    .then(readData => console.log(readData));

// or use it as a server method
app.post('/uploadFile', (req, res) => {
    SecureStorage.uploadFile({req}, (err, fileObj) => {
        console.log('Saved', fileObj)

// download file
// 'res' object from express will be filled with data and headers to be sent back to the client
app.get('/downloadFile', (req, res) => {
    SecureStorage.downloadFile('file-unique-name', res);

Key management

To generate a key, you can use the getRandomKey method provided with the package as:

const SecureStorage = require('loopback-secure-storage');
const key = SecureStorage.getRandomKey().hex;

// ... expected output:
// { bytes: [ 212, 202, 144, 124, 187, 170, 143, 47, 14, 139, 30, 72, 72, 165, 148, 68 ],
//   hex: 'd4ca907cbbaa8f2f0e8b1e4848a59444' }


Module can be tested with mocha by running the command npm run test.

⚠️ Test sequence uses the port 4201 to start a temporary express server. Please ensure it is available on your environment during this phase.