5

I'm trying to write a middleware to accept CSP report from browser. Browser issues application/csp-report as Content-Type. The request being posted is JSON format. Currently I use bodyParser.text to accept that Content-type. But I thought there might be a better way to accept application/csp-report as JSON in bodyParser.

Here's what I'm doing right now. 

app.use(bodyParser.json());
app.use(bodyParser.text({type: 'application/csp-report'}));

My question is how do I accept JSON request payload with Content-Type application-csp-report?

toy
  • 11,085
  • 22
  • 87
  • 171

2 Answers2

13

Since it is actually JSON you can inform Express of that fact like this:

app.use(bodyParser.json({type: 'application/csp-report'}));

Note however some browsers use application/csp-report, some application/json so I set both:

app.use(bodyParser.json({type: 'application/json'}));
app.use(bodyParser.json({type: 'application/csp-report'}));

If it helps I've code for a (very simple) Node Report service here: https://www.tunetheweb.com/security/http-security-headers/csp/

Mike
  • 12,690
  • 24
  • 87
  • 142
Barry Pollard
  • 35,640
  • 6
  • 72
  • 85
5

In addition to @Barry's answer, you can set endpoint path more specifically:

app.use('/report-violation', bodyParser.json({ type: 'application/json' }));
app.use('/report-violation', bodyParser.json({ type: 'application/csp-report' }));
app.use('/report-violation', (req, res) => {
  // handle req.body
});
IvanM
  • 2,673
  • 2
  • 27
  • 27