{"id":17490,"library":"alexa-verifier-middleware","title":"Alexa Request Verifier Middleware for Express","description":"alexa-verifier-middleware is an Express.js middleware designed to verify incoming HTTP requests to an Alexa skill endpoint, ensuring they originate from Amazon. The package is currently stable at version 2.1.0, though the README indicates a 3.x branch exists which is pure ESM. The release cadence appears to follow semantic versioning with major updates indicating breaking changes, such as the transition to ES modules. Its primary differentiator is its focused role in securing Alexa skill endpoints by verifying request authenticity, building upon the `alexa-verifier` module. This middleware is crucial for preventing spoofed requests and maintaining the security posture of an Alexa skill's backend service.","status":"active","version":"2.1.0","language":"javascript","source_language":"en","source_url":"https://github.com/alexa-js/alexa-verifier-middleware","tags":["javascript","alexa","alexa-verifier","alexa-verifier-middleware","typescript"],"install":[{"cmd":"npm install alexa-verifier-middleware","lang":"bash","label":"npm"},{"cmd":"yarn add alexa-verifier-middleware","lang":"bash","label":"yarn"},{"cmd":"pnpm add alexa-verifier-middleware","lang":"bash","label":"pnpm"}],"dependencies":[{"reason":"This package is an Express.js middleware and requires Express to function.","package":"express","optional":false}],"imports":[{"note":"For ESM projects (Node.js >=12.17 and `type: module` in package.json or `.mjs` files). CommonJS projects should use `require`.","wrong":"const express = require('express')","symbol":"express","correct":"import express from 'express'"},{"note":"Since v3.x, this package is pure ES module. For older versions or CommonJS projects, `require` is correct.","wrong":"const verifier = require('alexa-verifier-middleware')","symbol":"verifier","correct":"import verifier from 'alexa-verifier-middleware'"},{"note":"While alexa-verifier-middleware itself is a function, its usage within Express often benefits from Express types. The package ships its own types.","symbol":"alexa-verifier-middleware types","correct":"import type { Request, Response, NextFunction } from 'express';\nimport verifier from 'alexa-verifier-middleware';"}],"quickstart":{"code":"import express from 'express';\nimport verifier from 'alexa-verifier-middleware';\n\nconst app = express();\nconst alexaRouter = express.Router();\n\n// Create a router and attach to express before doing anything else\napp.use('/alexa', alexaRouter);\n\n// Attach the verifier middleware first because it needs the entire\n// request body, and express doesn't expose this on the request object.\nalexaRouter.use(verifier);\n\n// Add a body parser AFTER the verifier if needed for other routes or POST bodies.\nalexaRouter.use(express.json()); \n\n// Define your Alexa skill endpoint\nalexaRouter.post('/skill-endpoint', (req, res) => {\n  // In a real skill, you would process the Alexa request body here.\n  // For this example, we just acknowledge receipt.\n  console.log('Received Alexa request:', req.body);\n  res.json({\n    version: '1.0',\n    response: {\n      outputSpeech: {\n        type: 'PlainText',\n        text: 'Hello from your skill!'\n      }\n    }\n  });\n});\n\nconst PORT = process.env.PORT ?? 3000;\napp.listen(PORT, () => {\n  console.log(`Alexa skill listening on port ${PORT}`);\n});","lang":"typescript","description":"This quickstart demonstrates how to set up an Express.js server with the alexa-verifier-middleware, ensuring that incoming Alexa requests are validated before being processed by your skill's logic."},"warnings":[{"fix":"Migrate your project to use ES modules by adding `\"type\": \"module\"` to your `package.json` and using `import` statements, or stick to version 2.x for CommonJS compatibility.","message":"Version 3.x of alexa-verifier-middleware is a pure ES module. This means it can only be imported using `import` statements and is incompatible with CommonJS `require()` without specific configuration (e.g., dynamic import or build tooling).","severity":"breaking","affected_versions":">=3.0.0"},{"fix":"Ensure `app.use(verifier)` or `router.use(verifier)` is called before any `app.use(express.json())` or `app.use(bodyParser.json())` calls for the affected routes.","message":"The `alexa-verifier-middleware` must be loaded *before* any other middleware that parses the request body (e.g., `express.json()`, `body-parser`). The verifier requires access to the raw request body for signature verification.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Upgrade your Node.js environment to 12.17 or newer, or use `alexa-verifier-middleware@1.x` if you need to support older Node.js versions.","message":"The package requires Node.js version 12.17 or higher for versions 3.x. Older versions of Node.js are incompatible with the ES module syntax and features used.","severity":"gotcha","affected_versions":">=3.0.0"}],"env_vars":null,"last_verified":"2026-04-23T00:00:00.000Z","next_check":"2026-07-22T00:00:00.000Z","problems":[{"fix":"Place `alexaRouter.use(verifier)` *before* any body parsing middlewares like `alexaRouter.use(bodyParser.json())`.","cause":"Another middleware (e.g., `body-parser`) parsed the request body before `alexa-verifier-middleware` could access it for verification.","error":"The raw request body has already been parsed."},{"fix":"If using v3.x+, ensure your project is configured for ESM (`\"type\": \"module\"` in `package.json`) and use `import verifier from 'alexa-verifier-middleware'`. If using an older Node.js or CommonJS, use v2.x or earlier and `const verifier = require('alexa-verifier-middleware')`.","cause":"Attempting to `require()` an ESM-only version (3.x+) of the package in a CommonJS context, or an incorrect import statement for ESM.","error":"TypeError: verifier is not a function"}],"ecosystem":"npm","meta_description":null,"install_score":null,"install_tag":null,"quickstart_score":null,"quickstart_tag":null}