Body parsing

Active contributors: dougwilson, ulisesgascon, wesleytodd

Express does not have its own body parser. The four body-parsing middlewares it ships are direct re-exports from the body-parser package, attached as properties on the express module:

// lib/express.js (excerpt)
var bodyParser = require('body-parser');
exports.json = bodyParser.json;
exports.raw = bodyParser.raw;
exports.text = bodyParser.text;
exports.urlencoded = bodyParser.urlencoded;

That's the entire integration on the Express side.

Middlewares

Middleware	Reads	Sets req.body to
express.json([opts])	Bodies with Content-Type: application/json (or matching type option).	Parsed JSON object/array.
express.urlencoded([opts])	Bodies with Content-Type: application/x-www-form-urlencoded.	Parsed form object. With extended: true, uses qs; otherwise querystring.
express.text([opts])	Bodies with Content-Type: text/plain (or matching type option).	Decoded string.
express.raw([opts])	Bodies with Content-Type: application/octet-stream (or matching type option).	Buffer.

For options (limit, type, verify, inflate, strict, reviver, parameterLimit, extended, defaultCharset, etc.), see the body-parser README.

Usage patterns

Parse JSON globally

const express = require('express');
const app = express();

app.use(express.json({ limit: '1mb' }));

app.post('/echo', (req, res) => res.json(req.body));

Parse only on specific routes

app.post(
  '/raw-upload',
  express.raw({ type: 'application/octet-stream', limit: '5mb' }),
  (req, res) => {
    // req.body is a Buffer
  }
);

Parse multiple forms on different paths

app.use('/api', express.json());
app.use('/form', express.urlencoded({ extended: true }));

Where this used to live

Until Express 4, bodyParser() was bundled inside the express module itself. Express 4 (Mar 2014) extracted it into the body-parser package. Express 4.x and 5.x both re-export the four parsers as a convenience so users don't strictly need a direct dependency.

The 5.0 line bumped to body-parser@^2.0.1, then ^2.2.x for the 5.2.x line — see package.json and History.md.

Notable behaviour

• req.body is not initialised to {} in Express 5+ when no body parser ran. The 5.0 beta switched away from the previous "always set" behaviour.
• urlencoded's extended option defaults to false in Express 5+ (was true in older versions). The 5.2.0/5.2.1 saga in History.md involved an erroneous breaking change to extended-parser behaviour that was reverted on the same day.
• Each parser short-circuits if req.body is already populated (e.g., by another parser earlier in the stack).
• All four parsers use the type-is package to decide whether the request matches.

Related pages

• Architecture for the dependency map.
• Response — for the symmetric outbound helpers (res.json, res.send).
• Reference / Dependencies for full versions.