Parse only expected bodies

Start from the behavior you can observe. The JSON API accepts a small JSON document; the form route accepts URL-encoded input; neither accepts an unlimited arbitrary body.

Body parsing allocates work before business validation, so content type and size are part of the security boundary. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

It is tempting to install every parser globally with large defaults and accept mismatched content types. That trades a clear decision for an assumption you will eventually have to debug. The stronger move is to mount the required parser, enforce a conservative limit, and reject unsupported media types before domain work. Make the boundary explicit in code and in the project notes.

Tie the decision back to the larger job: Accept useful input while keeping parsing, validation, state, and privilege boundaries visible. Record enough evidence that another developer can repeat the result without relying on your memory.

Send valid, malformed, oversized, and wrong-content-type bodies and record the exact response for each. Repeat it once with an invalid or hostile condition and write down the boundary the failure revealed.