Express/Connect: Unable to parse body after making call to redis - express

Question

I am trying to shorten my Express/Connect middleware pipeline by only calling certain middleware functions based on the requested path.
However, the following will fail:
_cookieParser(req, res, function(err) {
if(err) return next(err);
_session(req, res, function(err) {
if(err) return next(err);
_csrf(req, res, function(err) {
if(err) return next(err);
loadUserFromSession(req, res, function(err) {
if(err) return next(err);
if(req.method == "POST") {
_bodyParser(req, res, next);
} else {
next();
}
});
});
});
});
But this will work fine:
_cookieParser(req, res, function(err) {
if(err) return next(err);
_session(req, res, function(err) {
if(err) return next(err);
_csrf(req, res, function(err) {
if(err) return next(err);
_bodyParser(req, res, function(err) {
if(err) return next(err);
loadUserFromSession(req, res, next);
});
});
});
});
Where loadUserFromSession is:
function loadUserFromSession(req, res, next) {
if(req.session && req.session.userId) {
userFunctions.getUserById(req.session.userId, function(err, user) {
if(err) return next(err);
if(user) {
req.user = user;
return next();
} else {
req.session.destroy();
return next(new Error('Unauthenticated'));
}
});
} else {
return next(new Error('Unauthenticated'));
}
};
Why can I not call bodyParser() after loadUserFromSession()?
EDIT
Sorry for the lack of detail on the failure/unexpected outcome.
If I put bodyParser() or just json() (since the POST content is json) after loadUserFromSession(), the calls never return inside of json(). If I put breakpoints in node inspector on either res.on('data') or res.on('end') neither get tripped.
The source of the json middleware is below:
exports = module.exports = function(options){
var options = options || {}
, strict = options.strict !== false;
var limit = options.limit
? _limit(options.limit)
: noop;
return function json(req, res, next) {
if (req._body) return next();
req.body = req.body || {};
if (!utils.hasBody(req)) return next();
// check Content-Type
if ('application/json' != utils.mime(req)) return next();
// flag as parsed
req._body = true;
// parse
limit(req, res, function(err){
if (err) return next(err);
var buf = '';
req.setEncoding('utf8');
req.on('data', function(chunk){
buf += chunk <==BREAKPOINT NEVER GETS CALLED
});
req.on('end', function(){
var first = buf.trim()[0]; <==BREAKPOINT NEVER GETS CALLED
if (0 == buf.length) {
return next(400, 'invalid json, empty body');
}
if (strict && '{' != first && '[' != first) return next(400, 'invalid json');
try {
req.body = JSON.parse(buf, options.reviver);
next();
} catch (err){
err.body = buf;
err.status = 400;
next(err);
}
});
});
}
};

Answer 1

OK, consider this advice/code review as opposed to a specific answer, but hopefully this helps.
First, my guess is understanding the following will solve your problem and unconfuse you, although I can't say exactly why your second example above behaves differently from the first example given your isolated snippets, but do some experiments base on this information: For a given request, the series of events (data, end, etc) will fire once and only once. If a listener is not attached when they fire, that listener never gets called. If a listener gets attached after they fire, it will never get called. The bodyParser has code to avoid attempting to re-parse the same request body more than once (because the necessary events would never fire and the code would hang without responding to the request).
SO, I suspect that in your app you have app.use(express.bodyParser()) and that middleware is getting called and running prior to your custom stuff above. Thus, my suggestion, which also addresses your file upload security question is:
Don't install the bodyParser globally like you see in the examples: app.use(express.bodyParser()). This code is neat for day-1 example apps, but it's totally inappropriate for a production site. You should instead do something like:
app.post('/upload/some/file', express.bodyParser(), myUploadHandler);
And just use the body parser exactly where it's needed and nowhere else. Don't go further down your stack of bizarre nesty middleware. There are clean ways to get the functionality, security, and efficiency you need that work in HARMONY with the middleware stack design built into connect. In general, understand that you can use different middleware stacks on different paths and express/connect can be configured to nicely match what you want to happen on a path-by-path basis.