Express query parser depth and pagination limit enforcement

Pagination and Query Constraints

For a central security policy, a maximum pagination limit of 100 is a standard industry baseline. This prevents "resource exhaustion" attacks where a client requests millions of rows in a single call, potentially crashing the Node.js process or locking the database.

Centralized Limit Enforcement

Because Express does not provide a native global configuration to cap the number of query parameters or the total length of the query string, you must implement a global middleware. This avoids per-route duplication and ensures a consistent security posture across the application.

const paginationPolicy = (req, res, next) => {
  const MAX_LIMIT = 100;
  const DEFAULT_LIMIT = 20;

  // Ensure limit is a positive integer and capped
  let limit = parseInt(req.query.limit, 10);
  if (isNaN(limit) || limit <= 0) {
    limit = DEFAULT_LIMIT;
  } else if (limit > MAX_LIMIT) {
    limit = MAX_LIMIT;
  }

  // Ensure offset is a non-negative integer
  let offset = parseInt(req.query.offset, 10);
  if (isNaN(offset) || offset < 0) {
    offset = 0;
  }

  req.pagination = { limit, offset };
  next();
};

app.use(paginationPolicy);

Query Parser Depth and Practical Limits

The query parser configuration (specifically when using app.set('query parser', 'extended')) utilizes the qs library. This affects limits in the following ways:

• Nesting Depth: By default, qs limits nesting depth to 5. This prevents stack overflow and prototype pollution attacks via deeply nested objects.
• Parameter Count: The query parser does not natively cap the total number of parameters or the length of individual strings. A request with thousands of shallow parameters can still cause high CPU usage during parsing (Hash Flooding).
• Version Differences: While Express 5 changes how body-parsing middleware is bundled, the app.set('query parser', ...) mechanism remains the primary way to toggle between the qs library (extended) and the native querystring module (simple).

Verification Steps

To verify your constraints are active, perform the following tests:

1. Depth Test: Send a request with ?a[b][c][d][e][f]=1. If the depth limit is working, the object will be truncated or ignored at the 5th level.
2. Pagination Test: Send a request with ?limit=999999. Verify that your internal req.pagination.limit is clamped to 100.

Diagnostic Detail Needed: Are you using a reverse proxy (like Nginx or Cloudflare) in front of Express? These typically provide a client_header_buffer_size or large_client_header_buffers setting that is the most effective way to cap the total raw size of the query string before it ever reaches the Node.js event loop.