Put a bounded, validated request boundary between incoming JSON and application logic: limit the body before buffering, check its media type and encoding, parse it once with a maintained parser, validate structure and meaning, and only then use accepted values. Parsing confirms syntax—not that a request is safe, complete, or valid for the operation.
What a safe JSON request boundary should do
Treat the request body as untrusted until every stage succeeds. A robust sequence prevents oversized input from consuming resources before parsing, rejects representations the endpoint does not accept, catches malformed JSON, and prevents syntactically valid but inappropriate values from reaching business logic or storage.
As an Amazon Associate I earn from qualifying purchases.
- Enforce a body-size limit early. Apply the endpoint’s documented ceiling at the server, gateway, or framework boundary before the body is fully buffered. Reject an oversized request; OWASP’s REST guidance identifies HTTP 413 (Content Too Large) for this case. Set the limit to fit legitimate requests and infrastructure budgets rather than treating one number as safe for every API.
- Check the representation. For an endpoint that expects JSON, require its documented media type and reject missing or unexpected types according to the contract.
application/jsonis the registered JSON media type. OWASP recommends 415 Unsupported Media Type or 406 Not Acceptable for unexpected or missing request content types, while allowing an empty body to have no content type. RFC 8259; OWASP REST Security Cheat Sheet. - Decode consistently. Use UTF-8 for JSON exchanged between systems outside a closed ecosystem, and make sure every layer agrees on the encoding. Reject malformed input rather than letting components interpret it differently.
- Parse once with a maintained JSON parser. Catch parse failures and configure available limits appropriate to the endpoint, including text size, nesting depth, string length or contents, and numeric range or precision. Do not use
evalor an eval-like substitute: RFC 8259 warns that executable code could be included with data declarations, making this generally an unacceptable security risk. - Validate structure and meaning. Check the fields and relationships the operation actually accepts, as described below. Do not pass a partly checked object forward.
- Reject clearly and observe safely. Return the documented client error without a stack trace or internal implementation clues. If validation failures are logged, sanitize data before writing it to logs.
The order matters. A schema check after parsing cannot protect a parser that has already exhausted resources. OWASP’s Input Validation Cheat Sheet therefore recommends parsing safely before validating. Parser configuration and defaults differ by language and framework, so verify those settings in the official documentation for the implementation you deploy.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Validate parsed JSON before using it
A successful parse establishes that the text follows JSON syntax; it does not establish that the request meets the endpoint’s contract. Use framework validators or a schema validator, then apply operation-specific rules. Make required properties and the handling of additional properties explicit: listing a property in a schema does not necessarily make it required or cause unknown fields to be rejected.
#1 Best Overall
- Presence and types: require the properties the operation needs and verify each property’s expected type.
- Formats and bounds: constrain string lengths, numeric and date ranges, and allowable choices.
- Nested data: validate nested objects, array item schemas, and array lengths—not only the outer object.
- Business relationships: check combinations of values against the operation’s rules. A value of the right type can still be unacceptable; for example, an integer quantity may be outside the permitted range.
- Field binding: bind only intended input properties to application objects. Do not let unexpected client-supplied fields populate properties the endpoint did not intend to accept.
Reject the whole request when a required check fails; do not continue with a partially validated object. OWASP’s Input Validation Cheat Sheet covers structured-data validation, including explicit treatment of required and additional properties.
Handle duplicate keys and member ordering deliberately
JSON object names should be unique. RFC 8259 says they SHOULD be unique; when a document repeats a name, receivers may keep the last value, fail, or expose all values. That makes duplicate-key behavior unpredictable across parsers and systems. Avoid generating or relying on duplicate names. If the API must reject them, confirm the chosen parser can do so or add an intentional duplicate-detection step before ordinary object mapping.
Do not make application behavior depend on the order of object members. JSON objects are not a safe basis for order-dependent logic, and parser libraries may expose member order differently.
Free tools Windows power users keep installed
One-click scans. No signup required.
These interoperability rules are specified in RFC 8259, Sections 4 and 12.
Set numeric rules that work across your systems
JSON number syntax does not allow leading zeros and excludes NaN and Infinity. The RFC permits implementations to limit the numeric range and precision they accept; it does not define a universal application limit.
For implementations using IEEE 754 binary64, RFC 8259 identifies the exactly interoperable integer interval as [−(253) + 1, (253) − 1]. Values outside it, very large magnitudes such as 1E400, or long decimals may not be represented consistently by all components. Choose application-specific bounds and representations for money, identifiers, and high-precision values, and enforce them before values are used or stored. The interval is an interoperability note in the IETF’s December 2017 RFC 8259, not a universal limit imposed on every JSON implementation.
Rank #4
Make encoding and Unicode behavior consistent
For JSON exchanged outside a closed ecosystem, RFC 8259 requires UTF-8. Networked JSON generators must not add a byte-order mark, although parsers may ignore one for interoperability. The RFC also warns that unpaired UTF-16 surrogates can produce unpredictable behavior in receivers.
Agree on decoding rules across the gateway, application server, and parser, and reject malformed input consistently. Preserve legitimate scripts and punctuation rather than treating characters from a particular language as inherently unsafe. If comparisons require Unicode normalization, define the policy explicitly. Normalization is not sanitization and does not replace context-appropriate output encoding.
Document content types and client errors
Make the endpoint contract clear about which media types it accepts and what it returns for invalid input. For a JSON request, the body should match the declared content type. OWASP’s REST guidance recommends rejecting unexpected or missing request content types with 415 or 406, except when the body is empty; choose the behavior that fits the API and document it.
Choose and document a malformed-JSON status and error shape for the specific API. The cited guidance does not mandate one universal status for parse failures. A useful response identifies the client-side problem without returning a call stack, internal hints, or implementation details. Keep validation failures from reaching business logic, and sanitize any logged request data.
Review a parser and validation setup against the boundary
When choosing or reviewing a parser, framework, or schema-validation approach, verify these capabilities for the exact versions and configuration you deploy. This is an evaluation checklist, not a claim that every library supports each feature.
Quick Recap
- Can the server or gateway enforce the body ceiling before the full request is buffered?
- Can the parser be configured for suitable size, nesting-depth, string, and numeric limits?
- Can it detect duplicate object names if the API needs to reject them, and does it handle malformed Unicode as your contract requires?
- Can the validation layer require properties, define additional-property behavior, and validate nested objects and array items and lengths?
- Does a failure stop processing without leaving partially validated data available to business logic?
- Are framework defaults understood, and are limits and validation behavior observable without exposing sensitive input or internal details?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
