Only Accept application/json

Question

I am working on a backbone application that communicates with an express.js server. I'm think about securing the express.js server. Does it make sense to create a middleware that checks that any data sent to the server is in json form (so no multipart form)? I doubt it provides any added security but could help return better error codes.

Answer 1

It could work as a first line of filtering and is fairly simple. Just check the content type header and either reject or call next()

module.exports = function() {
  return function(req, res, next) {
    if(req.get('Content-Type').match(/application\/json/i) === null) { // no match
      return res.end(406, "Content type not accepted");
    };
    next(); // content type ok, move on to next middleware
  }
}