body-parser

body-parser is a Node.js middleware that parses incoming request bodies and makes them available under the req.body property.

Security Warning: Because req.body is based on user-controlled input, all properties and values are untrusted. You must validate all data before use. For example, calling req.body.foo.toString() is unsafe because foo might be missing, might not be a string, or toString might not be a function.

Limitations: This module does not handle multipart bodies (e.g., file uploads). For multipart bodies, use modules such as busboy, multiparty, formidable, or multer.

Install the body-parser middleware package using npm to enable parsing of incoming request bodies in your Node.js application.

$ npm install body-parser

All parsers accept a type option. Use this to instruct the middleware to parse custom or non-standard Content-Type headers.

const express = require('express')
const bodyParser = require('body-parser')

const app = express()

// parse various different custom JSON types as JSON
app.use(bodyParser.json({ type: 'application/*+json' }))

// parse some custom thing into a Buffer
app.use(bodyParser.raw({ type: 'application/vnd.custom-type' }))

// parse an HTML body into a string
app.use(bodyParser.text({ type: 'text/html' }))

To parse the bodies of all incoming requests in an Express application, add bodyParser.urlencoded() and bodyParser.json() as top-level middleware using app.use(). This is the simplest setup but applies to every request.

const express = require('express')
const bodyParser = require('body-parser')

const app = express()

// parse application/x-www-form-urlencoded
app.use(bodyParser.urlencoded())

// parse application/json
app.use(bodyParser.json())

app.use(function (req, res) {
  res.setHeader('Content-Type', 'text/plain')
  res.write('you posted:\n')
  res.end(String(JSON.stringify(req.body, null, 2)))
})

The recommended way to use body-parser is to apply specific parsers only to the routes that require them. This prevents unnecessary parsing on routes that do not expect a body.

const express = require('express')
const bodyParser = require('body-parser')

const app = express()

// create application/json parser
const jsonParser = bodyParser.json()

// create application/x-www-form-urlencoded parser
const urlencodedParser = bodyParser.urlencoded()

// POST /login gets urlencoded bodies
app.post('/login', urlencodedParser, function (req, res) {
  if (!req.body || !req.body.username) res.sendStatus(400)
  res.send('welcome, ' + req.body.username)
})

// POST /api/users gets JSON bodies
app.post('/api/users', jsonParser, function (req, res) {
  if (!req.body) res.sendStatus(400)
  // create user in req.body
})

You can import the main body-parser object to access all middleware factories, or import specific parsers directly to reduce your dependency footprint.

// Import all parsers
const bodyParser = require('body-parser')

// Or import individual parsers directly
const json = require('body-parser/json')
const urlencoded = require('body-parser/urlencoded')
const raw = require('body-parser/raw')
const text = require('body-parser/text')

Returns middleware that parses json bodies and populates req.body with the parsed data. It supports automatic inflation of gzip, br (brotli), and deflate encodings.

Common Options:

• defaultCharset: Default character set if not specified in Content-Type. Defaults to utf-8.
• inflate: Whether to inflate compressed bodies. Defaults to true.
• limit: Maximum request body size (e.g., '100kb'). Defaults to '100kb'. High limits (e.g., > 5MB) are discouraged due to memory and performance risks.
• reviver: A function passed to JSON.parse as the second argument.
• strict: If true, only accepts arrays and objects. Defaults to true.
• type: Media type to parse (string, array, or function). Defaults to application/json.
• verify: A function verify(req, res, buf, encoding) called with the raw buffer. Throwing an error here aborts parsing.

Returns middleware that parses all bodies as a string and populates req.body. Supports automatic inflation of gzip, br (brotli), and deflate encodings.

Common Options:

• defaultCharset: Default character set if not specified in Content-Type. Defaults to utf-8.
• inflate: Whether to inflate compressed bodies. Defaults to true.
• limit: Maximum request body size. Defaults to '100kb'.
• type: Media type to parse (string, array, or function). Defaults to text/plain.
• verify: A function verify(req, res, buf, encoding) called with the raw buffer. Throwing an error here aborts parsing.

Returns middleware that parses all bodies as a Buffer and populates req.body. Supports automatic inflation of gzip, br (brotli), and deflate encodings.

Common Options:

• inflate: Whether to inflate compressed bodies. Defaults to true.
• limit: Maximum request body size. Defaults to '100kb'.
• type: Media type to parse (string, array, or function). Defaults to application/octet-stream.
• verify: A function verify(req, res, buf, encoding) called with the raw buffer. Throwing an error here aborts parsing.