Installation
Copy the middleware file from the GitHub repository:Basic usage
Configuration options
Response headers
Fail-closed on internal verification errors
If a guard raises an unexpected exception mid-verification, the middleware refuses to forward the request. Instead of callingnext() and letting an unverified payload through, it responds with HTTP 500, X-QWED-Verified: false, X-QWED-Error, and code: "INTERNAL_VERIFICATION_ERROR":
500 from a /checkout-sessions route the same as a 422 — the request has not been verified and must not be settled.
Fail-closed on unparseable bodies
On a protected path and method, the middleware refuses to forward requests it cannot verify. Empty bodies and bodies that don’t decode to a JSON object are rejected with422, X-QWED-Verified: false, and code: "UNPARSEABLE_REQUEST" before your handler runs:
Make sure
express.json() is registered before createQWEDUCPMiddleware() so the middleware sees the parsed body. Send checkout payloads as application/json with a JSON object at the top level; arrays, primitives, and form-encoded bodies fail closed.