Body Parsing
Express DEFAULT se body parse NAHI karta — bina parser ke req.body undefined hota hai. express.json() JSON bodies parse karta hai (Content-Type: application/json) aur express.urlencoded({ extended: true }) HTML form data parse karta hai.
Parser par LIMIT set karna security ke liye zaroori hai — bina limit ke koi bhi 500MB ka JSON bhejkar memory bhar sakta hai. Default limit 100kb hai, use apni need ke hisaab se tune karo.
app.use(express.json({ limit: "1mb" }));
app.use(express.urlencoded({ extended: true }));
app.post("/users", (req, res) => {
console.log(req.body); // parsed object
res.status(201).json(req.body);
});- Bina body parser ke req.body undefined rehta hai
- express.json() JSON ke liye, express.urlencoded() form data ke liye
- limit option zaroor set karo — bade payloads memory attack ban sakte hain
express.json() sirf tab chalta hai jab request ka Content-Type "application/json" ho — warna wo body ko chhod deta hai. express.urlencoded({ extended: true }) HTML forms ka data parse karta hai; extended: true qs library use karta hai jo nested objects support karta hai (user[name]=Aarav).
app.use(express.json());
app.use(express.urlencoded({ extended: true }));
// Content-Type: application/json -> { "name": "Aarav" }
// Content-Type: application/x-www-form-urlencoded -> name=AaravDefault limit 100kb hai. Bade payloads ke liye limit badhao lekin soch samajh kar — bina limit ke ek attacker huge JSON bhejkar memory exhaust kar sakta hai. Webhook signature verification ke liye kabhi RAW body chahiye hoti hai, uske liye verify option use hota hai.
app.use("/webhooks/stripe", express.json({
verify: (req, res, buf) => { req.rawBody = buf; }, // signature check ke liye
}));