Express body-parser

The History of body-parser

In early Express 4.x, body parsing was deliberately removed from Express core and moved into a standalone body-parser package, keeping the framework itself lean. Developers had to npm install body-parser and require its .json() and .urlencoded() middleware separately.

Since Express 4.16 (released in 2018), the two most common parsers, JSON and urlencoded, were folded back into Express core as express.json() and express.urlencoded(). For most modern projects, installing body-parser as a separate dependency is no longer necessary.

// Old style (still works, but unnecessary today)
const bodyParser = require('body-parser');
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({ extended: true }));

// Modern style (Express 4.16+)
app.use(express.json());
app.use(express.urlencoded({ extended: true }));

Both snippets behave identically for JSON and urlencoded bodies, express.json() is literally powered by the same underlying parsing logic as body-parser.

When You Might Still Need body-parser Directly

npm install body-parser

const bodyParser = require('body-parser');
app.use(bodyParser.raw({ type: 'application/vnd.custom+octet-stream' }));

• For everyday JSON/urlencoded APIs, express.json()/express.urlencoded() are sufficient, skip the extra dependency.
• The standalone package still receives updates and exposes a couple of extra options/parsers.
• Older tutorials and codebases still reference body-parser directly, recognizing this pattern helps you read legacy code.
• Multipart form data (file uploads) was never handled by body-parser, and still requires a dedicated library like multer.

body-parser vs Built-In Cheatsheet

What changed between the legacy package and modern Express.

Migrating Old Code

If you inherit a codebase using the standalone body-parser package, migrating is usually a safe, mechanical find-and-replace, provided you're only using the JSON and urlencoded parsers.

// before
const bodyParser = require('body-parser');
app.use(bodyParser.json());

// after
app.use(express.json());

// then remove from package.json:
// npm uninstall body-parser

Options That Carry Over

The built-in express.json()/express.urlencoded() accept the same familiar options as their body-parser counterparts, limit, extended (urlencoded only), and type.

app.use(express.json({ limit: '2mb' }));
app.use(express.urlencoded({ extended: true, limit: '2mb' }));

Common Mistakes

• Installing body-parser as a dependency in a brand-new project when express.json() already covers the need.
• Assuming body-parser handles file uploads, it never did, and neither does express.json().
• Mixing legacy bodyParser.json() and modern express.json() calls in the same file for no reason.
• Forgetting { extended: true } on urlencoded(), which changes how nested form fields are parsed.

Key Takeaways

• body-parser was Express's original standalone body-parsing package.
• Since Express 4.16, express.json() and express.urlencoded() cover the same functionality built in.
• New projects generally don't need to install body-parser separately.
• Multipart form data (file uploads) is outside the scope of both, and needs a library like multer.