Request Handling in Backend Frameworks

import express from 'express';
import cookieParser from 'cookie-parser';

const app = express();

// 1. Mandatory Body Parsing Middleware (Buffers JSON stream into req.body)
app.use(express.json());

// 2. Cookie Parsing Middleware (Express has NO built-in cookie parser!)
app.use(cookieParser());

// Endpoint receiving data from ALL request locations:
app.post('/api/workspaces/:workspaceId/products/:productId', async (req, res) => {
  // ── 1. Path Parameters (from route pattern) ──
  // Always strings! req.params.productId === "42"
  const { workspaceId, productId } = req.params;

  // ── 2. Query Parameters (from URL ?key=value) ──
  // Live getter in Express 5
  const { currency = 'USD', notify = 'false' } = req.query;

  // ── 3. Request Headers (case-insensitive getter) ──
  // Preferred over req.headers['authorization']
  const authHeader = req.get('authorization');
  const clientVersion = req.get('x-client-version');

  // ── 4. Request Body (populated by express.json()) ──
  // Would be UNDEFINED if express.json() was omitted!
  const { quantity, shippingAddress } = req.body;

  // ── 5. Cookies (populated by cookie-parser) ──
  // Would be UNDEFINED without cookie-parser middleware!
  const sessionId = req.cookies?.session_id;

  // ⚠️ CRITICAL: Treat ALL extracted data as untrusted input!
  const numericId = parseInt(productId, 10);
  if (isNaN(numericId)) {
    return res.status(400).json({ error: 'Invalid product ID: must be an integer' });
  }

  // Pass sanitized, validated data to domain logic:
  return res.status(201).json({
    message: 'Order created',
    workspaceId,
    productId: numericId,
    currency,
    quantity,
    sessionVerified: Boolean(sessionId)
  });
});

from typing import Annotated
from fastapi import FastAPI, Header, Cookie, Path, Query, Body, Request, status
from pydantic import BaseModel

app = FastAPI()

# ── 1. Request Body Model (Pydantic) ──
class OrderCreate(BaseModel):
    quantity: int
    shipping_address: str

# Endpoint receiving data from ALL request locations:
@app.post(
    "/api/workspaces/{workspace_id}/products/{product_id}",
    status_code=status.HTTP_201_CREATED
)
async def create_order(
    # ── 1. Path Parameters (matched to {product_id} in URL) ──
    workspace_id: Annotated[str, Path(description="Workspace slug")],
    product_id: Annotated[int, Path(ge=1, description="Numeric product ID")],

    # ── 2. Query Parameters (defaulting & metadata) ──
    currency: Annotated[str, Query(description="Billing currency")] = "USD",
    notify: Annotated[bool, Query(description="Send email notification")] = False,

    # ── 3. Request Headers (automatic underscore-to-hyphen conversion) ──
    # 'x_client_version' automatically matches HTTP header 'X-Client-Version'
    authorization: Annotated[str, Header()],
    x_client_version: Annotated[str | None, Header()] = None,

    # ── 4. Request Body (Pydantic model deserialization) ──
    order_data: OrderCreate = Body(...),

    # ── 5. Cookies (read from Cookie header) ──
    session_id: Annotated[str | None, Cookie()] = None,

    # ── 6. Low-level Request Object (Only when direct raw access is required!) ──
    raw_request: Request = None,
):
    # FastAPI automatically coerced 'product_id' into a real Python int!
    # If the client sends "abc", FastAPI automatically returns HTTP 422.
    return {
        "message": "Order created",
        "workspace_id": workspace_id,
        "product_id": product_id,
        "currency": currency,
        "quantity": order_data.quantity,
        "session_verified": bool(session_id),
        "client_ip": raw_request.client.host if raw_request else None
    }