Why i cannot set property userId on this function?

Question

I’m building an authentication system with Express + JWT + Cookie. I have a middleware userAuth that decodes the token and puts the userId into req.body.

Here is the code:

import jwt from "jsonwebtoken";

const userAuth = async (req, res, next) => {
  const { token } = req.cookies;

  if (!token) {
    return res.json({ success: false, message: "Not Authorized Login Again" });
  }

  try {
    const tokenDecode = jwt.verify(token, process.env.JWT_SECRET);
    if (tokenDecode.id) {
      req.body.userId = tokenDecode.id; // <--- ERROR happens here
      next();
    } else {
      return res.json({ success: false, message: "Not Authorized Login Again" });
    }
  } catch (error) {
    return res.json({ success: false, message: error.message + " userAuth" });
  }
};

export default userAuth;

When I send a POST request from Postman with an empty raw body, I get this error:

Cannot set properties of undefined (setting 'userId')

What I Tried

I’m already using app.use(express.json()) in my server.js.
If I send a JSON body like {}, it works (no error).
But when the request body is completely empty, the error is show.

Question

How can I make sure that req.body.userId is not undefined in my middleware. so I can safely set req.body.userId, because i follow this video https://www.youtube.com/watch?v=7BTsepZ9xp8&t=64s is working.

Since there’s no body sent then there’s no body to modify. You could always create the object. But I would strongly recommend NOT to put any extra things into request body. What if the request coming in has that property? What if your middleware misbehaves and malicious user can just send the userId in? So many things can go wrong here. Rather add a property to the actual request object that the user cannot access. — Sami Kuhmonen
– Sami Kuhmonen, Commented Sep 6 at 6:52
You can do instead req.jwt = { userId: tokenDecode.id } without modifying the req.body — Yuvaraj M
– Yuvaraj M, Commented Sep 6 at 7:02
ahh ok but i'm really need the body to store user id bocouse the other functions is already using body to store the data. can you give me suggest to add userId on req.body ? — Ridwan Anugrah
– Ridwan Anugrah, Commented Sep 6 at 7:18
@RidwanAnugrah Then this was a mistake to use req.body for purposes it's not suitable for. You'd naturally have this problem for get requests too. I don't see much problem in removing .body part through the app — Estus Flask
– Estus Flask, Commented Sep 6 at 10:17

Abdulla Nilam · Accepted Answer · 2025-09-06 09:09:45Z

2

The error Cannot set properties of undefined (setting 'userId') happens because req.body is undefined when you send a request without any body, even though you have app.use(express.json()).

if (tokenDecode.id) {
  // makesure req.body exists before adding properties
  req.body = req.body || {};
  req.body.userId = tokenDecode.id;
  next();
}

Alternative (Recommended)

Instead of modifying the body, you can attach userId to req.user

req.user = { id: tokenDecode.id };
# to access in controller use `req.user.id`

answered Sep 6 at 9:09

Abdulla Nilam

39.7k18 gold badges85 silver badges115 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Ridwan Anugrah Sep 6 at 11:00

but in this video somehow it's work. youtube.com/watch?v=7BTsepZ9xp8&t=64s your can cek in the minute 01:52:17.

Collectives™ on Stack Overflow

Why i cannot set property userId on this function?

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related