Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslnode 18–226 runs
build_error
glibcnode 18–226 runs
build_error
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
hpp
✓ const hpp = require('hpp');
✗ import hpp from 'hpp';
As of version 0.2.3, `hpp` is primarily a CommonJS module. This `require` syntax is the most reliable way to import it in Node.js environments, even when using modern build tools that transpile to CJS.
hpp
✓ import hpp from 'hpp';
✗ import { hpp } from 'hpp';
When using `hpp` in an ESM context (e.g., `type: "module"` in `package.json` or with a bundler), the default import syntax is correct. Ensure your `tsconfig.json` or build configuration correctly handles CommonJS module interop.
Request
✓ import { Request } from 'express';
For TypeScript, `hpp` augments the `express.Request` interface with `queryPolluted` and `bodyPolluted`. You'll typically need to declare module augmentations for full type safety, for example:
```typescript
declare namespace Express {
interface Request {
queryPolluted?: { [key: string]: string[] };
bodyPolluted?: { [key: string]: string[] };
}
}
```
Demonstrates how to integrate `hpp` middleware into an Express application to protect against HTTP Parameter Pollution. It shows basic usage, how polluted parameters are moved to `req.queryPolluted` and `req.bodyPolluted`, and an example of whitelisting specific parameters for certain routes.
import express from 'express';
import hpp from 'hpp';
import bodyParser from 'body-parser';
const app = express();
const port = 3000;
// Make sure body-parser is used BEFORE hpp to allow hpp to process req.body.
app.use(bodyParser.urlencoded({ extended: true }));
app.use(bodyParser.json()); // Optional, but common. HPP only checks urlencoded for body.
// Add the HPP middleware. This secures all routes by default.
// It will move polluted parameters from req.query and req.body to req.queryPolluted and req.bodyPolluted.
app.use(hpp());
// Example route to demonstrate HPP's effect
app.get('/search', (req: express.Request, res: express.Response) => {
console.log('Original req.query (after HPP):', req.query);
console.log('Polluted req.query (if any):', req.queryPolluted);
res.send(`Search results for: ${req.query.q || 'N/A'}. Polluted: ${JSON.stringify(req.queryPolluted || {})}`);
});
app.post('/submit', (req: express.Request, res: express.Response) => {
console.log('Original req.body (after HPP):', req.body);
console.log('Polluted req.body (if any):', req.bodyPolluted);
res.send(`Submitted: ${req.body.item || 'N/A'}. Polluted: ${JSON.stringify(req.bodyPolluted || {})}`);
});
// Whitelisting example (as per README suggestion)
// If a specific route requires array parameters, apply HPP with a whitelist option.
app.get('/multi-select', hpp({ whitelist: ['selectedIds'] }), (req: express.Request, res: express.Response) => {
// For /multi-select?selectedIds=1&selectedIds=2
// req.query.selectedIds will be ['1', '2'] because of the whitelist here.
console.log('Multi-select req.query:', req.query);
res.send(`Selected IDs: ${req.query.selectedIds}`);
});
app.listen(port, () => {
console.log(`Server listening at http://localhost:${port}`);
console.log(`Test with:`);
console.log(`GET http://localhost:${port}/search?q=item1&q=item2`);
console.log(`POST http://localhost:${port}/submit -d "item=val1&item=val2" -H "Content-Type: application/x-www-form-urlencoded"`);
console.log(`GET http://localhost:${port}/multi-select?selectedIds=100&selectedIds=200`);
});
Errors
Common errors & fixes
TypeError: app.use() requires a middleware function but got a undefined
The `hpp` module was not correctly imported or required, resulting in `hpp()` being called on an undefined value.
fixEnsure you have `const hpp = require('hpp');` or `import hpp from 'hpp';` at the top of your file and `hpp` is correctly installed via `npm install hpp`. Parameters in req.body are not being filtered by HPP.
The `hpp` middleware is placed *before* `body-parser` middleware, or the request body is not `application/x-www-form-urlencoded`.
fixVerify that `app.use(hpp())` is called after `app.use(bodyParser.urlencoded({ extended: true }))`. Also, confirm the client is sending `Content-Type: application/x-www-form-urlencoded` for the body to be processed by `hpp`. Audit
Dependencies
expressrequiredHPP is an Express middleware, requiring an Express application to function.
body-parseroptionalRequired for `hpp` to process `req.body` parameters from POST requests. `hpp` must be applied *after* `body-parser` to function correctly for request bodies.