Validate webhook payload types
Before parsing a webhook payload, verify that the request declares JSON and reject other media types.
Express.js · Module
req.is
req.is() checks whether the request Content-Type matches a MIME type or extension. It returns the matched type, false for a mismatch, or null when there is no body.
How it works
Call req.is(type) to test the incoming request's Content-Type against a MIME type or extension. It reports the matching type, false for a mismatch, and null when the request has no body.
Syntax
req.is(type)Parameters
| Name | Type | Description |
|---|---|---|
type | String | String[] | MIME type or extension name, or an array of MIME types and extension names, to compare with the request Content-Type. |
Returns
String | false | null
Key points
- The type parameter accepts one MIME type, an extension name, or an array of candidates.
- A match returns the content type that satisfied the comparison.
- A bodyless request produces null rather than a successful match or mismatch.
- The method returns false when the supplied type does not match the request.
- Matching ignores parameters such as the charset when checking a MIME type.
- Wildcard media ranges let a route accept any subtype within a MIME family.
Common mistakes
- Handle null separately from false: null means the request has no body, whereas false means its Content-Type did not match.
- A successful result is the matched type string, not a boolean true value.
Example: Check a request's Content-Type
const express = require('express');
const app = express();
app.use(express.json());
app.post('/webhook', (req, res) => {
if (req.is('json')) {
return res.json({ accepted: true });
}
return res.status(415).send('Expected JSON');
});
app.listen(3000);The route accepts the request only when its Content-Type matches JSON; otherwise it returns 415.
When to use it
Match MIME families
Accept any subtype in a media family, such as text/*, when a route supports several textual formats.
Support multiple content types
Use a list of accepted MIME types or extensions for an endpoint supporting multiple representations.
Interview questions
QWhat does req.is() return?
req.is(type) compares the request’s Content-Type header with a MIME type or extension name. It returns the matching content type when successful, false on mismatch, and null when the request has no body.
Follow-up: How would you distinguish an empty-body request from an unsupported media type? Check for null first; treat false as an unsupported or nonmatching Content-Type.
QWhat can be passed as the type argument?
The type argument can be a string or an array of strings. Each value represents a MIME type or extension name to compare with the request’s Content-Type.
Follow-up: Why might an extension such as json be convenient? Express can match that extension against the corresponding MIME type, avoiding a longer literal MIME string.
QHow can req.is() validate a JSON request?
Use req.is('json') when a route expects JSON, or a wildcard such as req.is('text/*') when any text subtype is acceptable. A matching request produces the matching type string; a nonmatching one produces false.
Follow-up: What response is appropriate for a nonmatching type? Reject the payload with an unsupported-media-type response, commonly HTTP 415.
Related
req.get()req.bodyreq.headersexpress.json()