When handling incoming requests in your web application, you should limit the size of the request body. Incoming requests with

unlimited body sizes can lead to your application crashing due to a denial-of-service outage or other unwanted side-effects.

Many popular middleware-solutions for parsing request bodies, such as already-included `body-parser` package for express, expose

options to limit the sizes of request payloads, making it easy for developers to implement this functionality. You can also

integrate a request body size limit in your reverse-proxy/web server software if supported. Below are examples for limiting request sizes using

`express` and/or `nginx`.

const express = require('express');

const app = express();

const parseJsonBody = express.json({ limit: '300kb' }); // body-parser defaults to a body size limit of 100kb

const handleErrors = (err, req, res, next) => res.sendStatus(400); // simple express middleware to handle body parsing error

app.post('/json', parseJsonBody, handleErrors, (req, res) => {

// Check if request payload content-type matches json, because body-parser does not check for content types

if (!req.is('json')) {

return res.sendStatus(415); // -> Unsupported media type if request doesn't have JSON body

}

res.send('Hooray, it worked!');

});

app.listen(3000, () => console.log('Example app listening on port 3000!'));

🔗 [**Express docs for express.json()**](http://expressjs.com/en/4x/api.html#express.json)

🔗 [**Nginx docs for client_max_body_size**](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size)