The Issue of Security with express.bodyParser()

Many responses suggest using the express.bodyParser() middleware, but it's worth noting that this actually wraps around several other middlewares like express.json(), express.urlencoded(), and express.multipart() (http://expressjs.com/api.html#bodyParser). The important parsing of form request bodies is handled by the express.urlencoded() middleware, which is all that is necessary to access your form data on the req.body object.

There are concerns over security due to how express.multipart()/connect.multipart() creates temporary files for uploaded files (which are not properly disposed of), leading to a security issue. Therefore, it is now recommended to avoid using the express.bodyParser() wrapper and instead only utilize the necessary middlewares.

Note: Once Connect 3.0 is released (which Express extends), connect.bodyParser() will be updated to include only urlencoded and json.

In summary, rather than...

app.use(express.bodyParser());

...it is advised to use:

app.use(express.urlencoded());
app.use(express.json());      // if needed

And if handling multipart forms (such as file uploads) becomes necessary, consider utilizing third-party libraries or middlewares like multiparty, busboy, dicer, etc.

Important: This response is tailored for Express 2. If you are using Express 3, please refer to this link.

If you are working with connect/express, it is recommended to utilize the bodyParser middleware: Details can be found in the Expressjs guide.

// Here's an example using express.js:
var express = require('express')
  , app = express.createServer();
app.use(express.bodyParser());
app.post('/', function(req, res){
  var email = req.param('email', null);  // default value set as second parameter
});

Shown below is the original version exclusively for connect:

// Example using just connect
var connect = require('connect');
var url = require('url');
var qs = require('qs');
var server = connect(
  connect.bodyParser(),
  connect.router(function(app) {
    app.post('/userlogin', function(req, res) {
      // bodyParser places parsed request data in req.body.
      var parsedUrl = qs.parse(url.parse(req.url).query);
      var email = parsedUrl.email || req.body.email;
    });
  })
);

The parsing of both querystrings and bodies is done with Rails-style parameter handling (qs) instead of the more basic querystring library. To parse repeated parameters efficiently with qs, ensure parameters have brackets: name[]=val1&name[]=val2. It also supports nested maps. Furthermore, besides processing HTML form submissions, bodyParser can automatically handle JSON requests.

Note: After researching express.js further, I have adjusted my response to better suit users of Express.

If you're looking to construct the posted query directly without middleware, this code snippet can help achieve that:

app.post("/register/", function(req, res) {
    var bodyStr = '';
    req.on("data", function(chunk) {
        bodyStr += chunk.toString();
    });
    req.on("end", function() {
        res.send(bodyStr);
    });

});

This will output the following to the browser:

email=emailval&password1=pass1val&password2=pass2val

However, it is recommended to use middleware to avoid repeating this code in every route.

Note for users of Express version 4:

For those attempting to include app.use(express.bodyParser()); in their application, an error will occur when trying to launch the Express server:

Error: Most middleware (such as bodyParser) is no longer bundled with Express and must be installed separately. Please refer to https://github.com/senchalabs/connect#middleware.

To resolve this issue, it is necessary to install the package body-parser independently from npm by visiting this link, then implementing something along the lines of the following code snippet (excerpt sourced from the GitHub page):

var express    = require('express');
var bodyParser = require('body-parser');

var app = express();

app.use(bodyParser());

app.use(function (req, res, next) {
  console.log(req.body) // populated!
  next();
})

Here is an example form:

<form action='/examplepath' method='post'>
   <input type='text' name='username'></input>
</form>

When using the express framework:

app.post('/examplepath', function(req, res) {

    console.log(JSON.stringify(req.body));

    console.log('req.body.username', req.body['username']);
});

The resulting output will be:

{"name":"John","age":30}
req.param.name John

Server-side:

import express from 'express';
import bodyParser from 'body-parser';

const server = express();
server.use(bodyParser.json()); // Middleware to parse request body as JSON

server.post('/api/data', (req, res) => {
  res.json(req.body);
});

Client-side:

fetch("/api/data", {
  method: 'POST',
  body: JSON.stringify({ greeting: 'hello' }), // Convert JavaScript object to a string
  headers: new Headers({ "Content-Type": "application/json" }) // Define content type in headers
});

app.enable('trust proxy');

To handle the app.put request, you can access put values using req.body.{put request variable}.

Important Update: Express 4.4.1

A recent update to Express has resulted in the removal of certain middleware.

• The following middleware has been removed from Express:
• bodyParser
• json
• urlencoded
• multipart

If you try to directly use this middleware as you did in Express 3.0, an error will occur:

Error: Most middleware (such as urlencoded) is no longer included with Express and 
must be installed separately.

To continue using these middleware functionalities, you now need to install each middleware separately using npm.

Since bodyParser has been deprecated, I recommend utilizing json, urlencode, and a multipart parser such as formidable or connect-multiparty. (Note that Multipart middleware is also deprecated).

It's important to note that simply defining urlencode + json will not parse form data, resulting in req.body being undefined. You must define a middleware handle for multipart requests.

var urlencode = require('urlencode');
var json = require('json-middleware');
var multipart = require('connect-multiparty');
var multipartMiddleware = multipart();

app.use(json);
app.use(urlencode);
app.use('/route/for/form-data', multipartMiddleware);

Latest Update

Starting from Express version 4.16+, their own built-in body-parser is now integrated into the default Express package, eliminating the need for an additional dependency.

If you had previously added this line of code:

app.use(bodyparser.json()); //utilizes the body-parser package

You can now replace it with:

app.use(express.json()); //Used for parsing JSON bodies

This transition should not cause any disruptions to your applications, as express.json() has similar functionality to bodyparser.json().

If you also have the following code in your setup:

app.use(bodyParser.urlencoded({extended: true}));

You can swap it out for:

app.use(express.urlencoded()); //Parse URL-encoded bodies

It's worth noting that there may still be certain scenarios where using body-parser remains necessary, but in most cases, Express' implementation of body-parser covers the majority of use cases effectively.

(Refer to the documentation at expressjs/bodyparser for further information).

I encountered the same issue and was diligently following all the recommendations provided, yet I continued to receive an empty object {} when accessing req.body. It turned out that the problem in my case was a simple one related to incorrect HTML formatting.

When constructing your form's HTML, ensure that you include the 'name' attribute in your input tags, not just the 'id'. Without the name attribute, the data will not be parsed correctly.

<input id='foo' type='text' value='1'/>             // req = {}
<input id='foo' type='text' name='foo' value='1' /> // req = {foo:1}

My oversight may serve as a valuable lesson for you.

Avoid using app.use(express.bodyParser()). BodyParser combines json, urlencoded, and multipart functionalities. It's recommended not to use it as the multipart feature will be eliminated in connect 3.0.

To address this issue, you can utilize the following:

app.use(express.json());
app.use(express.urlencoded());

Remember that it is crucial to include app.use(app.router) after implementing the json and urlencoded middleware for it to work correctly!

Upgrading to Express 4.1 and Beyond

Many developers rely on Express, bodyParser, and connect for handling multipart data, but with the deprecation of connect.multipart(), there is a more secure method available.

Multer can serve as a replacement for connect.multipart().

To install Multer:

$ npm install multer

Integrate it into your application:

var multer = require('multer');

Then, add it to your middleware stack along with other form parsing middleware:

app.use(express.json());
app.use(express.urlencoded());
app.use(multer({ dest: './uploads/' }));

connect.json() manages application/json

connect.urlencoded() manages application/x-www-form-urlencoded

multer() manages multipart/form-data

Express v4.17.0

app.use(express.urlencoded( {extended: true} ))

app.post('/userlogin', (req, res) => {    

   console.log(req.body) // object

   var email = req.body.email;

}

Learn more about express.urlencoded here

Check out the Demo Form

Explore Another Related Answer

Created with Express version 4.16

When working inside the router function, you can utilize the req.body property to retrieve the post variable data. For instance, if this route is for a POST form submission, it will return the inputted values:

function(req,res){
      res.send(req.body);

      //req.body.email would correspond to the HTML <input name="email"/>
}

By the way, for those who know PHP: To access PHP's $_GET variable, Node.js uses req.query, and to access PHP's $_POST variable, Node.js uses req.body.

I successfully implemented request streaming

req.on('end', function() {
    var data = postdata.split("&");
});

var postdata = "";
req.on('data', function(chunk){
    postdata += chunk;
});

Using the code snippet below, I was able to retrieve all parameters for both POST and GET requests.

const express = require('express');
const app = express();
const util = require('util');

app.get('/', function (req, res) {
    console.log("Got a GET request for the homepage");
    res.send(util.inspect(req.query, false, null));
})

While other responses focus on server-side middleware solutions, I aim to provide developers with a straightforward playbook for debugging the issue themselves.

Let's break down the scenario:

• You're working with a form on the client side
• Data is submitted by clicking a Submit button without using JavaScript (so no fetch, axios, xhr, etc.)
• You're utilizing Express on the server side
• You find that you can't access data in your Express code as req.body returns undefined

Here are steps you can take to troubleshoot on your own:

1. Inspect the Network tab to locate your request.
2. Check the request header Content-Type. For form submissions, the header usually reads

   application/x-www-form-urlencoded

   or multipart/form-data if files are being sent.
3. Verify that your Express code includes the proper middleware for parsing incoming requests.

• If the Content-Type is

  application/x-www-form-urlencoded

  , make sure you have

  app.use(express.urlencoded({extended: true}))

  in your code.

• If the Content-Type is multipart/form-data: since Express lacks built-in middleware for this type of request, consider using a library like multer.

4. If you've completed the above steps, you should now be able to access data in req.body :). If you encounter syntax issues, refer to the Express documentation. Keep in mind that syntax may have changed over time.

This playbook can be expanded for scenarios involving JavaScript code. Remember to check the request Content-Type - for application/json, include app.use(express.json()) in your code.

To summarize, identify your request's Content-Type and apply the appropriate middleware for parsing it.

Extracted from the official version 4 documentation

const express = require('express')
const app = express()
app.use(express.json());
app.use(express.urlencoded({ extended: true })) 

app.post('/push/send', (request, response) => {
  console.log(request.body)
})

const express = require("express");
const bodyParser = require("body-parser");
const app = express();

app.use(bodyParser.urlencoded({ extended: false }));
app.use(bodyParser.json());

app.get('/', function(req, res){
  res.sendFile("index.html");
});
app.post('/login', function(req, res){
  const user_name = req.body.user;
  const password = req.body.password;
  console.log("User name is " + user_name + ", and the password is " + password);
  res.end("yes");
});
app.listen(3000, function(){
  console.log("Server started on PORT 3000");
})

To retrieve Post Parameters, you can use the following method:

app.post('/api/v1/test', myTestFunction);
http.createServer(app).listen(port, function(){
    console.log("Server running on port " + port)
});

function myTestFunction(req, res, next) {
   console.log(req.param("val1"));
   res.send('Hello');
}

One efficient method is to utilize the express-fileupload package:

const app = require('express')();
const http = require('http').Server(app);
const fileUpload = require('express-fileupload');

app.use(fileUpload());

app.post('/', function(req, res) {
  const email = req.body.email;
  res.send('<h1>Email :</h1> ' + email);
});

http.listen(3000, function(){
  console.log('Server running on Port: 3000');
});

It appears that you are using req.query.post incorrectly. The correct method for req.query.post is to use method=get, while method=post should be used with body-parser.

To rectify this issue, simply change post to get as shown below:

<form id="loginformA" action="userlogin" method="get">
<div>
    <label for="email">Email: </label>
    <input type="text" id="email" name="email"></input>
</div>
<input type="submit" value="Submit"></input>  
</form>

Additionally, remember to use 'app.get' in your express code.