Express can parse JSON request bodies with built-in middleware. After parsing, the body is available through req.body.
Never trust client input. Validate required fields, data types, lengths, formats, and allowed values before processing or saving data.
Deep dive
Never trust req.body
Even when JSON parsing succeeds, the contents can still be invalid. Validate types and business rules before using the values.
Example validation questions
- Is the field present?
- Is it the expected type?
- Is the length acceptable?
- Is the value within the allowed range?
- Does the user have permission to submit it?
ADVERTISEMENT