How to change the `express.json` limit option based on the route.

[marbuser]

I've got some endpoints and 90% of them I want to have a limit of around '2MB'. However, there is 1 specific route, my upload route, where I want to have an upload limit of '10MB'.

I'm using router.use and that doesn't seem to play nice.
For example, this doesn't work;

import express from 'express';

const router = express.Router();

app.use(express.json({ limit: '2MB' }));

router.use('/products', products);
router.use('/uploads', express.json({ limit: '10MB' }), uploads);

app.use('/v4', router);

I thought about making a middleware that just checks if the req.path is '/uploads', but it seems calling express.json() from a middleware causes some issue.

Not sure whether this is a bug or if I'm just being dumb, but some help would be appreciated. :)

[dougwilson]

Ideally we recommend you use the middleware only specifically on the routes that need that body parsed (http://expressjs.com/en/resources/middleware/body-parser.html#express-route-specific) which would also allow you to control all aspect on a per-route basis.

If you want to still use a global middleware, you would need to rearrange your code above as follows:

import express from 'express';

const router = express.Router();

router.use('/uploads', express.json({ limit: '10MB' }));
app.use(express.json({ limit: '2MB' }));

router.use('/products', products);
router.use('/uploads', uploads);

app.use('/v4', router);

[marbuser]

Ideally we recommend you use the middleware only specifically on the routes that need that body parsed (http://expressjs.com/en/resources/middleware/body-parser.html#express-route-specific) which would also allow you to control all aspect on a per-route basis.

If you want to still use a global middleware, you would need to rearrange your code above as follows:

import express from 'express';

const router = express.Router();

router.use('/uploads', express.json({ limit: '10MB' }));
app.use(express.json({ limit: '2MB' }));

router.use('/products', products);
router.use('/uploads', uploads);

app.use('/v4', router);

Hey @dougwilson ,

I want to avoid the "per-route" path since I'm building a REST API and basically all of the routes in my app are using JSON and nothing else.

Regarding your example provided, I don't think that is a viable option for me. I slimmed down the code provided a lot to get my point across, but in my actual project I have a collection of other middleware such as;

• Helmet
• Compression
• Rate Limiter
• Authorization

Am I right in saying the express.json middleware should ideally always be the first to run? Or does it not really matter? Because if so, this option definitely isn't viable for me since I would need to move my uploads route above my global authorisation middleware (as well as the others) which definitely isn't good!

[dougwilson]

Hi @marbuser there is no requirement by express.json as to the order. If neither of those two things work for you, there are many, many other possibilities, but in order for me to provide an example, I would need to be able to understand what your currently layout actually looks like.

[marbuser]

@dougwilson

This is my current layout.

import express from 'express';
import compression from 'compression';
import helmet from 'helmet';

import rateLimiter from '../middleware/rateLimiter';
import Authorization from '../middleware/Authorization';
import products from '../routes/products';
import uploads from '../routes/uploads';

const router = express.Router();

app.use(express.json({ limit: '2MB' }));
app.use(helmet());
app.use(compression());
app.use(rateLimiter);
app.use(Authorization);

router.use('/products', products);
router.use('/uploads', uploads);

app.use('/v4', router);

So if the order of express json doesn't matter, I could just do this?

import express from 'express';
import compression from 'compression';
import helmet from 'helmet';

import rateLimiter from '../middleware/rateLimiter';
import Authorization from '../middleware/Authorization';
import products from '../routes/products';
import uploads from '../routes/uploads';

const router = express.Router();

app.use(helmet());
app.use(compression());
app.use(rateLimiter);
app.use(Authorization);
router.use('/uploads', express.json({ limit: '10MB' }), uploads);
app.use(express.json({ limit: '2MB' }));

router.use('/products', products);

app.use('/v4', router);

[marbuser]

@dougwilson Just an update, the suggestion you provided of putting the uploads route before the app.use one didn't work sadly. :(

[dougwilson]

Sorry it's not working for you. I would like to help, but there isn't enough information. Would you be willing to share the source code that isn't working at all?

[marbuser]

@dougwilson
I am not sure why you need the full source-code to solve this issue? I don't see what benefit or insight it would give over the code I've already shared.

Perhaps I can provide a better example than the code above...
In the code below, I want to make 1 route use the raw body-parser, and the rest use JSON.

import express from 'express';
import helmet from 'helmet';

import Auth from '../middleware/Auth';
import payments from '../routes/payments';
import users from '../routes/users';

const router = express.Router();

export default app => {
  app.use(express.json());
  app.use(helmet());
  app.use(Auth);

  // SHOULD BE JSON
  // Has a sub route /payments/webhooks which SHOULD BE RAW
  router.use('/payments', payments);
  // SHOULD BE JSON
  router.use('/users', users);

  app.use('/v1', router);
}

[dougwilson]

Hi @marbuser the reason would be because I already gave the only answer I had based on the information provided and you weren't happy with it. Without any more information, I don't know how I can provide any different answer.

For your new code, the route that should be raw, do you want the content-type: application/json to be raw, or a different content-type? And if application/json is submitted to that route do you want it to parse and then you reject it or to act as if there is no parser present on the route at all?

[dougwilson]

A follow up question is does Auth use the req.body at all? And does router need the JSON body as well?

[marbuser]

@dougwilson
Well the route is a webhook for Stripe, and in their docs they recommend this; require('body-parser').raw({type: '*/*'}). Basically I just need the request as a raw byte buffer so that it can pass their signature check. Every other request apart from that should be parsed as JSON.

No, Auth doesn't use req.body. However, it does use headers and the request object to store some information like the user token/information.

I want it to be so that the 1 route for the webhook is parsed as a raw buffer, and then EVERY other route is parsed as json.

[dougwilson]

Gotcha. So then you can achieve that with the following modification of your example:

import bodyParser from 'body-parser';
import express from 'express';
import helmet from 'helmet';

import Auth from '../middleware/Auth';
import payments from '../routes/payments';
import users from '../routes/users';

const router = express.Router();

export default app => {
  app.use('/payments/webhooks', bodyParser.raw({type: '*/*'}));
  app.use(express.json());
  app.use(helmet());
  app.use(Auth);

  // SHOULD BE JSON
  // Has a sub route /payments/webhooks which SHOULD BE RAW
  router.use('/payments', payments);
  // SHOULD BE JSON
  router.use('/users', users);

  app.use('/v1', router);
}

Edit: express.raw will be available in Express 4.17, my apologies. I update the example to use body-parser.

[marbuser]

Gotcha. So then you can achieve that with the following modification of your example:

import bodyParser from 'body-parser';
import express from 'express';
import helmet from 'helmet';

import Auth from '../middleware/Auth';
import payments from '../routes/payments';
import users from '../routes/users';

const router = express.Router();

export default app => {
  app.use('/payments/webhooks', bodyParser.raw({type: '*/*'}));
  app.use(express.json());
  app.use(helmet());
  app.use(Auth);

  // SHOULD BE JSON
  // Has a sub route /payments/webhooks which SHOULD BE RAW
  router.use('/payments', payments);
  // SHOULD BE JSON
  router.use('/users', users);

  app.use('/v1', router);
}

Edit: express.raw will be available in Express 4.17, my apologies. I update the example to use body-parser.

Ok that appears to work. Thank you for your help and having some patience with me. :)