Request Processing
Body Size Limiting
Limit request body size to prevent memory issues and protect against denial-of-service attacks.
Basic Body Size Limiting
MoroJS provides built-in body size limiting middleware to prevent memory exhaustion and protect against large payload attacks.
Global Body Size Limittypescript
1import { middleware } from '@morojs/moro';
2
3// Global body size limit
4app.use(middleware.bodySize({
5 limit: '10mb',
6 message: 'Request body too large'
7}));
8
9// All routes now have a 10MB limit
10app.post('/api/data', (req, res) => {
11 // Request body is automatically validated
12 return { success: true, data: req.body };
13});Body Size Features
- Global and per-route body size limits
- Support for different content types
- Human-readable size formats (mb, kb, etc.)
- Custom error messages
- Automatic request rejection for oversized payloads
Per-Route Limits
Route-Specific Body Size Limitstypescript
1import { middleware } from '@morojs/moro';
2
3// Per-route limits
4app.post('/api/upload')
5 .bodySize({ limit: '50mb' })
6 .handler((req, res) => {
7 // Handle large upload
8 return { success: true };
9 });
10
11// JSON-specific limit
12app.use(middleware.bodySize({
13 limit: '1mb',
14 jsonLimit: '100kb' // Stricter limit for JSON
15}));
16
17// Different limits for different content types
18app.use(middleware.bodySize({
19 limit: '10mb',
20 jsonLimit: '1mb',
21 textLimit: '5mb',
22 urlencodedLimit: '2mb'
23}));Best Practices
Do
- Set appropriate limits for each route
- Use stricter limits for JSON endpoints
- Set higher limits for file upload endpoints
- Provide clear error messages
- Monitor body size violations
- Use different limits per content type
Don't
- Set unlimited body sizes
- Use the same limit for all routes
- Ignore body size limits
- Set limits too high for security
- Skip body size validation
- Allow very large JSON payloads