Backslash in JSON on request body for ExpressJS- with body-parser - node.js

Question

Everything looks like OK unless a backslash char in JSON comes from client to the Express server with body-parser.
Request body is like this (We put this onto Postman (raw value) and Swagger-UI as is:
{
"username": "admin",
"password": "abc%\-xyz"
}
Postman's curl code is like this:
curl -X POST \
http://localhost:3000/login \
-H 'Content-Type: application/json' \
-H 'Postman-Token: ef96edfd-dc43-47fe-89c0-76e562fa206d' \
-H 'cache-control: no-cache' \
-d '{
"username": "admin",
"password": "abc%\-xyz"
}'
Swagger-UI's curl code:
curl -X POST "http://localhost:3000/login" -H "accept: application/json" -H "Content-Type: application/json" -d "{ \"username\": \"admin\", \"password\": \"abc%\\-xyz\"}"
I . don't know what's the difference between Swagger-UI and Postman but it looks like there is one more backslash in Swagger's curl. But there is no difference on the server side.
Indeed, I cannot control the request body which comes from the client and the passwords can have such characters like backslash. App always gives this error:
SyntaxError: Unexpected number in JSON at position 45
at JSON.parse (<anonymous>)
at parse (/path/to/project/node_modules/body-parser/lib/types/json.js:93:19)
at /path/to/project/node_modules/body-parser/lib/read.js:121:18
at invokeCallback (/path/to/project/node_modules/raw-body/index.js:224:16)
at done (/path/to/project/node_modules/raw-body/index.js:213:7)
at IncomingMessage.onEnd (/path/to/project/node_modules/raw-body/index.js:273:7)
at IncomingMessage.emit (events.js:189:13)
at endReadableNT (_stream_readable.js:1103:12)
at process._tickCallback (internal/process/next_tick.js:63:19)
If JSON becomes with two backslashes (\):
{
"username": "admin",
"password": "abc%\\-xyz"
}
Then there is no error anymore on the server side (inside of the route.post() function) but the body.password has still two backslashes: abc%\\-xyz
As it was stated on the comments, it may be a problem of parsing.
What is the correct way to deal with this?
bodyParser.json({strict: false}) doesn't help

Answer 1

You are just trying to fix broken clients.
The fact that your server already accepts passwords with a backslash shows this.
If you turn on strict mode for your Jason parser, everything becomes moredictable, as the parser no longer tries to make educated guesses on how it thinks your data should look. This also means that you now have to send JSON from your postman client, instead of your self-invented protocol, so send "test\\" when your password is \.
This is because a slash (and a double quote) have special meaning when used in a JSON string, and thus they get special treatment, somethings that other characters don't get. The same goes for when someones password contains a ", if this is the case, a client must send \" to your server.