body-parser — Request Body Parsing Middleware for Express

Introduction

body-parser is the de facto request body parsing middleware for Express and Connect-based Node.js applications. It reads the incoming request stream, parses the body based on the Content-Type header, and populates req.body with the result. While Express 4.16+ includes built-in equivalents (express.json() and express.urlencoded()), body-parser remains widely used for its additional parsers and fine-grained configuration options.

What body-parser Does

• Parses JSON request bodies and populates req.body with the parsed object
• Parses URL-encoded form data with support for nested objects via qs library
• Parses raw binary bodies into a Buffer for webhook signatures and binary protocols
• Parses plain text bodies into a string
• Handles content encoding, size limits, and charset detection

Architecture Overview

body-parser works by registering middleware functions that listen for specific Content-Type headers. When a matching request arrives, it reads the raw bytes from the request stream using the raw-body module, decompresses if gzip or deflate encoding is detected, then passes the bytes to the appropriate parser (JSON.parse, qs.parse, or identity). The parsed result is assigned to req.body. If parsing fails, it calls next(err) with a descriptive error. Each parser is a separate middleware function, so you mount only the parsers you need.

Self-Hosting & Configuration

• Install via npm and require or import the package
• Mount bodyParser.json() for JSON APIs
• Mount bodyParser.urlencoded({ extended: true }) for HTML form submissions
• Set limit option to control maximum body size (default 100KB for JSON)
• Use type option to parse custom Content-Types as JSON or URL-encoded

Key Features

• JSON parser with reviver support and strict mode for arrays/objects only
• URL-encoded parser with extended mode using qs for nested object support
• Configurable size limits to prevent denial-of-service via oversized payloads
• Content encoding support for gzip and deflate compressed bodies
• verify callback for request body verification (useful for webhook signature checking)

Comparison with Similar Tools

• express.json() / express.urlencoded() — built-in Express equivalents based on body-parser; body-parser offers raw and text parsers too
• multer — handles multipart/form-data for file uploads; body-parser handles JSON and URL-encoded only
• co-body — Koa-compatible body parser; body-parser is Express/Connect-specific
• formidable — full-featured multipart parser; body-parser focuses on non-file body types

FAQ

Q: Do I still need body-parser with Express 4.16+? A: For JSON and URL-encoded parsing, express.json() and express.urlencoded() are sufficient. Use body-parser if you need raw or text parsing, or want the verify callback.

Q: How do I increase the body size limit? A: Pass { limit: '10mb' } (or any size string) to the parser middleware.

Q: How do I handle webhook signature verification? A: Use the verify option: bodyParser.json({ verify: (req, res, buf) => { req.rawBody = buf; } }) to access the raw buffer for HMAC comparison.

Q: Does it handle file uploads? A: No. body-parser does not handle multipart bodies. Use multer or busboy for file uploads.

Sources

• https://github.com/expressjs/body-parser
• https://www.npmjs.com/package/body-parser