Posting non string data hangs execution

[oneEyedSunday]

Posting non string data hangs execution

[jessety]

Hey @oneEyedSunday!

Could you share an example of a POST request body that fails? The roundtrip.js example in the Express middleware repo makes a request with a JSON body that parses and validates.

Thanks!

[oneEyedSunday]

Hello @jessety the roundtrip example worked.

Here's a breakdown of my problem, before I mention how I eventually solved it.

The middleware needs to compare the req.rawBody prop,

internally it tries to parse this in parallel, via

// Populate the rawBody attribute by reading the input stream
    // Because this function calls next() immediately and not on 'end', it can consume the data stream in parallel with the body parsers we're going to add below
    // Of course, this also means that if it wasn't followed by middleware that waits until request emits 'end' to call next() that the rawBody would never be populated by the time the authentication middleware gets the request
    // We counter that by including yet another piece of middleware after the body-parsers that resolves immediately if it finds a parsed body, or sets an observer for the request 'end'
    // Whew.
    middleware.push((request, response, next) => {

      const chunks = [];

      request.on('data', chunk => chunks.push(chunk));
      request.on('end', () => request.rawBody = Buffer.concat(chunks).toString());

      next();
    });

but this doesn't work properly especially in my case where I have body parser.json much earlier in the pipeline on my api route namespace. I've experienced a similar issue before when integrating with Stripe webhooks as stripe expects us to verify the webhook request contents.

the key is to let the JSON middleware populate the req.rawBody like so thanks to flavio copes

json({ limit: '', verify: (req, res, buf) => {
  req.rawBody = buf;
} })

This way, the hmac auth middleware reliably has access to req.rawBody

I think having a prior middleware chain do it is perhaps more reliable, and perhaps should be documented, as a lot of people may have this use case. Its very likely, a lot of the middleware configuration with regards to parsing will be done much earlier in the middleware chain before the hmac auth middleware is called.

For the sake of people coming to see this in the future, one could conditionally do the req.rawBody population like so

app.use('/api', json({ strict: false, limit: '1mb', verify: function populateRawBody(req, res, buffer) {
  // Only do this if we need req.rawBody downstream
  if (aCondition) req.rawBody = buffer;
} }));