Returns middleware that only parses JSON and only looks at requests wherethe Content-Type header matches the type option. This parser accepts anyUnicode encoding of the body and supports automatic inflation of gzip anddeflate encodings.
A new body object containing the parsed data is populated on the requestobject after the middleware (i.e. req.body), or an empty object () ifthere was no body to parse, the Content-Type was not matched, or an erroroccurred.
Returns middleware that parses all bodies as a Buffer and only looks at requestswhere the Content-Type header matches the type option. This parser acceptsany Unicode encoding of the body and supports automatic inflation of gzip anddeflate encodings.
A new body Buffer containing the parsed data is populated on the requestobject after the middleware (i.e. req.body), or an empty object () ifthere was no body to parse, the Content-Type was not matched, or an erroroccurred.
The root argument specifies the root directory from which to serve static assets.The function determines the file to serve by combining req.url with the provided root directory.When a file is not found, instead of sending a 404 response, it calls next()to move on to the next middleware, allowing for stacking and fall-backs.
When this option is true, client errors such as a bad request or a request to a non-existentfile will cause this middleware to simply call next() to invoke the next middleware in the stack.When false, these errors (even 404s), will invoke next(err).
Use false if you have mounted this middleware at a path designedto be strictly a single file system directory, which allows for short-circuiting 404sfor less overhead. This middleware will also reply to all methods.
Returns middleware that parses all bodies as a string and only looks at requestswhere the Content-Type header matches the type option. This parser acceptsany Unicode encoding of the body and supports automatic inflation of gzip anddeflate encodings.
A new body string containing the parsed data is populated on the requestobject after the middleware (i.e. req.body), or an empty object () ifthere was no body to parse, the Content-Type was not matched, or an erroroccurred.
Returns middleware that only parses urlencoded bodies and only looks atrequests where the Content-Type header matches the type option. Thisparser accepts only UTF-8 encoding of the body and supports automaticinflation of gzip and deflate encodings.
A new body object containing the parsed data is populated on the requestobject after the middleware (i.e. req.body), or an empty object () ifthere was no body to parse, the Content-Type was not matched, or an erroroccurred. This object will contain key-value pairs, where the value can bea string or array (when extended is false), or any type (when extendedis true).
The locals object is used by view engines to render a response. The objectkeys may be particularly sensitive and should not contain user-controlledinput, as it may affect the operation of the view engine or provide a path tocross-site scripting. Consult the documentation for the used view engine foradditional considerations.
You can access local variables in templates rendered within the application.This is useful for providing helper functions to templates, as well as application-level data.Local variables are available in middleware via req.app.locals (see req.app)
You can provide multiple callback functions that behave just like middleware, exceptthat these callbacks can invoke next('route') to bypassthe remaining route callback(s). You can use this mechanism to impose pre-conditionson a route, then pass control to subsequent routes if there is no reason to proceed with the current route.
Add callback triggers to route parameters, where name is the name of the parameter or an array of them, and callback is the callback function. The parameters of the callback function are the request object, the response object, the next middleware, the value of the parameter and the name of the parameter, in that order.
If name is an array, the callback trigger is registered for each parameter declared in it, in the order in which they are declared. Furthermore, for each declared parameter except the last one, a call to next inside the callback will call the callback for the next declared parameter. For the last parameter, a call to next will call the next middleware in place for the route currently being processed, just like it would if name were just a string.
Param callback functions are local to the router on which they are defined. They are not inherited by mounted apps or routers, nor are they triggered for route parameters inherited from parent routers. Hence, param callbacks defined on app will be triggered only by route parameters defined on app routes.
All param callbacks will be called before any handler of any route in which the param occurs, and they will each be called only once in a request-response cycle, even if the parameter is matched in multiple routes, as shown in the following examples.
The behavior of the app.param(name, callback) method can be altered entirely by passing only a function to app.param(). This function is a custom implementation of how app.param(name, callback) should behave - it accepts two parameters and must return a middleware.
The first parameter of this function is the name of the URL parameter that should be captured, the second parameter can be any JavaScript object which might be used for returning the middleware implementation.
In this example, the app.param(name, callback) signature remains the same, but instead of a middleware callback, a custom data type checking function has been defined to validate the data type of the user id.
Returns the rendered HTML of a view via the callback function. It accepts an optional parameterthat is an object containing local variables for the view. It is like res.render(),except it cannot send the rendered view to the client on its own.
Enable escaping JSON responses from the res.json, res.jsonp, and res.send APIs. This will escape the characters , and & as Unicode escape sequences in JSON. The purpose of this it to assist with mitigating certain types of persistent XSS attacks when clients sniff responses for HTML.
Indicates the app is behind a front-facing proxy, and to use the X-Forwarded-* headers to determine the connection and the IP address of the client. NOTE: X-Forwarded-* headers are easily spoofed and the detected IP addresses are unreliable.
When enabled, Express attempts to determine the IP address of the client connected through the front-facing proxy, or series of proxies. The `req.ips` property, then contains an array of IP addresses the client is connected through. To enable it, use the values described in the trust proxy options table.
In Express 4, req.files is no longer available on the req object by default. To access uploaded fileson the req.files object, use multipart-handling middleware like busboy, multer,formidable,multiparty,connect-multiparty,or pez.
Even if you use a path pattern or a set of path patterns to load the router,the baseUrl property returns the matched string, not the pattern(s). In thefollowing example, the greet router is loaded on two path patterns.
When the trust proxy setting does not evaluate to false,the value of this property is derived from the left-most entry in theX-Forwarded-For header. This header can be set by the client or by the proxy.
When the trust proxy setting does not evaluate to false,this property contains an array of IP addressesspecified in the X-Forwarded-For request header. Otherwise, it contains anempty array. This header can be set by the client or by the proxy.
When you use a regular expression for the route definition, capture groups are provided in the array using req.params[n], where n is the nth capture group. This rule is applied to unnamed wild card matches with string routes such as /file/*:
7fc3f7cf58