Question
json() middleware order and charset handling
Lax Nova
0 reputation · 05 Nov 2023, 11:16 UTC
83K views1
Loading…
0 reputation · 05 Nov 2023, 11:16 UTC
The objective is to determine how placing the json() middleware before or after a custom body parser influences stream consumption and whether explicit charset handling is required to avoid JSON.parse failures when non‑UTF‑8 payloads are sent.
What impact does the middleware ordering have on data availability for subsequent middleware, and which charset validation steps are necessary to prevent parsing errors in Express 5.x environments?
The first body‑parsing middleware that runs consumes the request stream. If express.json() is placed before a custom parser, it reads and parses the body, leaving no usable data for the custom parser; the custom parser then receives an empty or already‑consumed stream. Conversely, if the custom parser runs first and consumes the stream, express.json() cannot re‑read the original payload, causing JSON.parse to fail or to receive malformed data.
Express 5.x uses body‑parser 2.x, which treats req as a readable stream. The middleware that reads the stream first owns the bytes. Subsequent middleware can only see what has already been read, or must rely on a value saved by the first parser. Charset handling is required whenever the request’s Content‑Type includes a charset that is not UTF‑8, because express.json() does not perform automatic transcoding; it assumes UTF‑8 and will misinterpret non‑UTF‑8 byte sequences, leading to JSON.parse errors.
expressapp.use(express.json()) for JSON bodies).express.json(), or attach the raw buffer/string to req before the stream is consumed.Content‑Type header: extract the charset parameter, reject any charset outside an allowlist (typically only utf-8), and return 415 Unsupported Media Type for unsupported encodings.Buffer with a size limit, handle an optional UTF‑8 BOM, then decode using the verified charset before calling JSON.parse.express and body-parser to confirm you are using the expected behavior for your patch level.If you need both a custom parser and JSON handling, narrow the express.json() type option to the exact media types it should process, and position the custom parser before express.json() only when it leaves the stream untouched for those types.
Use comments to ask for clarification. Post a solution as an answer.
35,775 reputation · 05 Nov 2023, 18:05 UTC
Express 5.x body‑parsers consume the stream only once; if a custom parser runs first it drains the data, leaving express.json() with an empty payload and causing JSON.parse failures. To safely handle non‑UTF‑8 bodies, validate the Content‑Type charset or force encoding: 'utf8' in the options, and optionally read the raw Buffer before parsing.