Introduction

Restana is a lightweight and fast Node.js framework for building RESTful APIs. Inspired by Express, it provides a simple and intuitive API for routing, handling requests and responses, and middleware management. It is designed to be easy to use and integrate with other Node.js modules, allowing developers to quickly build scalable and maintainable APIs.

Read more online:

• restana = faster and efficient Node.js REST APIs: https://itnext.io/restana-faster-and-efficient-node-js-rest-apis-1ee5285ce66

Check it yourself: https://web-frameworks-benchmark.netlify.app/result?f=feathersjs,0http,koa,nestjs-express,express,sails,nestjs-fastify,restana

Usage

Install

npm i restana

Create an HTTP API service:

const restana = require('restana')

const service = restana()
service.get('/hi', (req, res) => res.send('Hello World!'))

service.start(3000)

Creating secure API service:

const https = require('https')
const restana = require('restana')

const service = restana({
  server: https.createServer({
    key: keys.serviceKey,
    cert: keys.certificate
  })
})
service.get('/hi', (req, res) => res.send('Hello World!'))

service.start(3000)

Using http.createServer():

const http = require('http')
const restana = require('restana')

const service = restana()
service.get('/hi', (req, res) => res.send('Hello World!'))

http.createServer(service).listen(3000, '0.0.0.0')

Security defaults

Restana ships with secure defaults out of the box:

• Error handling: The default error handler only returns the status code and its standard status text (e.g. Not Found), preventing internal details (stack traces, database errors, file paths) from leaking to clients. Provide a custom errorHandler to control what gets exposed.
• Stream safety: Stream errors are handled gracefully, preventing connection leaks.
• Immutable config: getConfigOptions() returns a frozen copy, preventing middleware from mutating internal framework options.
• Response headers: Browser hardening headers are enabled by default, and connection-specific or cookie headers cannot be injected through res.send().
• Proxy safety: Forwarded protocol headers are ignored unless trustProxy: true is explicitly configured.

For local-only development, bind explicitly to loopback:

service.start(3000, '127.0.0.1')

When TLS terminates at a trusted reverse proxy:

const service = restana({ trustProxy: true })

Error details are hidden by default in every environment. For local debugging only, opt in with debugErrors: true; production mode always masks details.

7.0 highlights

• Dependency-free trie router by default: constant-time static routes and no match cache to tune.
• Case-sensitive routing that agrees with reverse proxies and WAFs (caseSensitive: false to opt out).
• Consistent error responses from res.send(err) and the default error handler.
• Faster startup: no third-party modules are loaded by default.
• TypeScript route params inferred from the path ('/users/:id' → req.params.id).
• Stricter res.send() status code handling and a typed, explicit public API.

Upgrading from 6.x? Read the migration guide.

More

• Website and documentation: https://restana.21no.de
• Full API guide
• Changelog
• Migration guide (6.x → 7.0)
• Contributing