hpp

HTTP Parameter Pollution prevention middleware for Express — protect your app from query string and body parameter duplication attacks.

hpp

Express

HTTP Parameter Pollution prevention middleware for Express — protect your app from query string and body parameter duplication attacks.

npmGitHubDocs

Fit

Bundle (gzip)

26.2 kB

158.7 kB raw

Install size includes transitive dependencies. Bundle size is gzipped browser payload.

Freshness

The Problem

When a URL contains duplicate query parameters (e.g. ?role=user&role=admin), Express populates req.query.role as an array. Code that expects a string but receives an array can behave unexpectedly — potentially bypassing validation or authorization logic.

What It Does

hpp middleware consolidates duplicate parameters by keeping only the last value and moving the others to req.queryPolluted. This prevents parameter pollution attacks while preserving access to the raw duplicates. A whitelist option allows intentional array parameters.

Installation

bash
npm install hpp

Usage Example

typescript
import hpp from 'hpp';

app.use(hpp({
  whitelist: ['tags', 'categories'], // allow arrays for these params
}));

// GET /search?role=user&role=admin&tags=js&tags=ts
// req.query.role    === 'admin'       (last value wins)
// req.query.tags    === ['js', 'ts']  (whitelisted, stays as array)
// req.queryPolluted.role === ['user', 'admin'] (original preserved)

Related packages

body-parserExpress

Node.js body parsing middleware — populate `req.body` from JSON, urlencoded, text, and raw payloads.

compressionExpress

HTTP response compression middleware for Express — gzip/deflate responses to reduce bandwidth and improve load times.

cookie-parserExpress

Cookie parsing middleware for Express — parse Cookie headers into `req.cookies` and support signed cookies for tamper detection.

corsExpress

CORS middleware for Express — configure cross-origin resource sharing with a single line of code.

express-async-errorsExpress

Simplify Express error handling by automatically passing thrown errors to `next()`.