If node module `body-parser` is not safe, what is the next solution?

Question

I read a post on body-parser in node.js and it claimed that it is not safe.

If I'm not to use any body-parser middleware in my project, what solution should I use to ensure safety?

Do Not Use bodyParser with Express.js

body-parser deprecation message

I'm a newbie on node.js so if your solution is provided with examples, I'll really appreciate!

Thx in advance!

score 1 · Accepted Answer · answered Jun 26 '14 at 18:12

1

The solution is provided in the very article you linked to.

Avoid bodyParser and explicitly use the middleware that you need

If you want to parse json in your endpoint, use express.json() middleware. If you want json and urlencoded endpoint, use [express.json(), express.urlencoded()] for your middleware.

If you want users to upload files to your endpoint, you could use express.multipart() and be sure to clean up all the temp files that are created. This would still stuffer [sic] from problem #3 previously mentioned.

Note however that in Express 4, these middlewares are no longer packaged with Express. They are now available via the body-parser package, with json and urlencoded properties. They recommend some other packages for multipart uploads.

answered Jun 26 '14 at 18:12

Scimonster

32,893
9
77
89

What are the recommended packaged?? :P – Adam Jun 26 '14 at 18:23
I said in my post, `body-parser` package, and enable `json` and `urlencoded` as needed. – Scimonster Jun 26 '14 at 18:32
Quoted: `They recommend some other packages for multipart uploads`. I mean this one. I'm not to use body-parser anymore because of unsafety. :P – Adam Jun 26 '14 at 18:34
Check the link. They have a bunch of links at the very beginning of the readme. – Scimonster Jun 26 '14 at 19:35
I found this helpful - http://stackoverflow.com/questions/24330014/bodyparser-is-deprecated-express-4 – Dave Pile Mar 21 '15 at 01:16

score -1 · Answer 2 · answered Jun 26 '14 at 18:11

-1

I'm using https://www.npmjs.org/package/busboy

But there are several other libraries that do the same thing, so there is no definitive answer to this question.

answered Jun 26 '14 at 18:11

Khôi

2,133
11
10

If node module `body-parser` is not safe, what is the next solution?

2 Answers2

Avoid bodyParser and explicitly use the middleware that you need

Linked