Request size limits in Express - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a request exceeds the size limit in Express?

Consider an Express app using express.json({ limit: '1kb' }) middleware. What is the behavior when a client sends a JSON payload larger than 1 kilobyte?

Express

const express = require('express');
const app = express();
app.use(express.json({ limit: '1kb' }));
app.post('/data', (req, res) => {
  res.send('Received');
});

A The server responds with status 413 Payload Too Large error.

B The server truncates the request body to 1kb and processes it normally.

C The server crashes with an unhandled exception.

D The server ignores the size limit and processes the full request body.

💡 Hint

Think about HTTP status codes related to request size limits.

Express's body parser middleware rejects requests exceeding the specified limit by sending a 413 Payload Too Large response.

📝 Syntax

intermediate

Which option correctly sets a 500kb limit for JSON requests in Express?

Choose the correct way to set a JSON body size limit of 500 kilobytes using Express middleware.

A app.use(express.json({ sizeLimit: 500000 }));

B app.use(express.json({ limit: '500kb' }));

C app.use(express.json({ maxSize: '500kb' }));

D app.use(express.json({ limit: 500 }));

💡 Hint

Check the official option name and format for size limits.

The correct option is limit with a string value specifying size units like 'kb'.

🔧 Debug

advanced

Why does this Express app not enforce the request size limit?

Given the code below, why does the server accept requests larger than 2kb?

Express

const express = require('express');
const app = express();
app.post('/submit', (req, res) => {
  res.send('OK');
});
app.use(express.urlencoded({ limit: '2kb' }));

A The limit option only applies to JSON, not URL-encoded data.

B express.urlencoded does not support the limit option.

C The middleware is applied after the route handler, so it has no effect.

D The limit value should be a string with units like '2kb', not a number.

💡 Hint

Check the order of middleware and route definitions.

Middleware and routes are executed in the order they are added to the app. Here, the route handler is added first and executes before the body parser middleware, so the size limit check does not occur before the route processes the request.

❓ state_output

advanced

What is the value of req.body after a too-large JSON request?

In an Express app with express.json({ limit: '1kb' }), if a client sends a JSON payload of 2kb, what will req.body be inside the route handler?

Express

const express = require('express');
const app = express();
app.use(express.json({ limit: '1kb' }));
app.post('/test', (req, res) => {
  res.json({ body: req.body });
});

A null, because the body parser returns null on error.

B An empty object {}, because the body is cleared on error.

C The full JSON object sent by the client, ignoring the limit.

D undefined, because the middleware rejects the request before parsing.

💡 Hint

Consider what happens when the middleware rejects a request.

If the request exceeds the size limit, the middleware sends an error response and does not populate req.body.

🧠 Conceptual

expert

How to globally enforce request size limits for all content types in Express?

You want to limit the size of all incoming requests regardless of content type (JSON, URL-encoded, text, etc.) to 10kb. Which approach achieves this correctly?

A Use a custom middleware that checks <code>req.headers['content-length']</code> and rejects if over 10kb.

B Use <code>app.use(express.raw({ limit: '10kb' }))</code> only, which covers all types.

C Use <code>app.use(express.json({ limit: '10kb' }))</code> and <code>app.use(express.urlencoded({ limit: '10kb' }))</code> together.

D Set <code>app.use(express.text({ limit: '10kb' }))</code> only, which applies to all requests.

💡 Hint

Think about how Express parses different content types and what headers are available.

Express body parsers handle specific content types. To enforce a global size limit, checking the content-length header in a custom middleware is the reliable way.