Stop 01 · Web & Internet FoundationsTopics · 7/10

JSON

Part of the Full Stack Developer Roadmap

In short

Almost every API you build will speak JSON. On the server you parse it, check it and send it back, and tiny slips here turn into confusing bugs.

JavaScript Object Notation — a lightweight, human-readable text format for structuring data, and the de facto standard for API request/response payloads between frontend and backend.

The mascot opens a stacked steel tiffin with dal, rice, sabzi and rotis in separate compartments.

Think of it like this

The labelled steel tiffin

Each compartment has a label: dal, rice, sabzi. One holds a stack of rotis, another even holds a smaller tiffin. Anyone opening it knows what's where. JSON packs data the same way: labelled keys, values, lists, and boxes inside boxes.

Watch it happen

Reading an order body

order { }

id: 42

user { }

name: "Asha"

items [ ]

[0] "Notebook"

[1] "Pen"

paid: true

1/5The whole body is one object in curly braces: a set of key-value pairs.

The big ideas

What you need to know

Only six kinds of value

Strings, numbers, booleans, null, arrays and objects. Keys and strings always use double quotes.

Dates become strings

JSON has no date type. JSON.stringify turns a Date into an ISO string like "2026-01-15T10:00:00.000Z".

Bad JSON throws

JSON.parse throws on broken input. express.json() catches that and replies 400 before your handler runs.

Parsing isn't validating

Valid JSON can still have the wrong fields or types. Check them yourself or with a library like zod.

See it in code

Walk through the code

1app.use(express.json({ limit: "100kb" }));2 3app.post("/orders", (req, res) => {4  const { item, qty } = req.body ?? {};5  if (typeof item !== "string" || !Number.isInteger(qty)) {6    return res.status(400).json({ error: "item (string) and qty (integer) required" });7  }8  res.status(201).json({ item, qty, createdAt: new Date() });9});10 11const text = JSON.stringify({ createdAt: new Date(0), note: undefined });12console.log(text); // {"createdAt":"1970-01-01T00:00:00.000Z"}

1/4Parse JSON bodies, and refuse anything bigger than 100 KB.

express.json() turns the request body into req.body and rejects broken JSON with a 400. The last two lines show what JSON quietly does to dates and undefined.

Save yourself the pain

Common mistakes

Oops

Trusting req.body has the right fields because 'the frontend always sends them'.

Do this instead

Anyone can call your API with curl. Check types and required fields on the server every time.

Oops

Sending money as floats like 99.99.

Do this instead

Use whole numbers in the smallest unit (9999 paise) or strings, to avoid floating-point rounding surprises.

Your mission

Try to break the parser

~15 min

Quick check

What does JSON.stringify({ when: new Date(), tags: new Set(["a"]) }) produce?

Go deeper

1Practice converting objects to JSON with `JSON.stringify` and back with `JSON.parse`.
2Inspect a real API response's JSON structure in your browser's DevTools.
3Learn valid JSON syntax rules (double quotes, no trailing commas, no comments).