{"action":"created","issue":{"url":"https://api.github.com/repos/strongloop/express/issues/2713","labels_url":"https://api.github.com/repos/strongloop/express/issues/2713/labels{/name}","comments_url":"https://api.github.com/repos/strongloop/express/issues/2713/comments","events_url":"https://api.github.com/repos/strongloop/express/issues/2713/events","html_url":"https://github.com/strongloop/express/issues/2713","id":96188523,"number":2713,"title":"Is there a reason that the urf-8 charset for JSON responses are hardcoded?","user":{"login":"behrangsa","id":18451,"avatar_url":"https://avatars.githubusercontent.com/u/18451?v=3","gravatar_id":"","url":"https://api.github.com/users/behrangsa","html_url":"https://github.com/behrangsa","followers_url":"https://api.github.com/users/behrangsa/followers","following_url":"https://api.github.com/users/behrangsa/following{/other_user}","gists_url":"https://api.github.com/users/behrangsa/gists{/gist_id}","starred_url":"https://api.github.com/users/behrangsa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/behrangsa/subscriptions","organizations_url":"https://api.github.com/users/behrangsa/orgs","repos_url":"https://api.github.com/users/behrangsa/repos","events_url":"https://api.github.com/users/behrangsa/events{/privacy}","received_events_url":"https://api.github.com/users/behrangsa/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-20T23:31:38Z","updated_at":"2015-07-20T23:37:42Z","closed_at":"2015-07-20T23:37:42Z","body":"We are implementing some consumer driver contracts, and our consumers at the moment expect the `Content-Type` header to just be `application/json` with no charset.\r\n\r\nHowever in Express, the `utf-8` encoding is enforced:\r\n\r\n```javascript\r\n// write strings in utf-8\r\n  if (typeof chunk === 'string') {\r\n    encoding = 'utf8';\r\n    type = this.get('Content-Type');\r\n\r\n    // reflect this in content-type\r\n    if (typeof type === 'string') {\r\n      this.set('Content-Type', setCharset(type, 'utf-8'));\r\n    }\r\n  }\r\n```\r\n\r\nThe only way to skip this is by using `Buffer`s.\r\n\r\nIs there a reason for this hardcoded encoding?"},"comment":{"url":"https://api.github.com/repos/strongloop/express/issues/comments/123093752","html_url":"https://github.com/strongloop/express/issues/2713#issuecomment-123093752","issue_url":"https://api.github.com/repos/strongloop/express/issues/2713","id":123093752,"user":{"login":"dougwilson","id":67512,"avatar_url":"https://avatars.githubusercontent.com/u/67512?v=3","gravatar_id":"","url":"https://api.github.com/users/dougwilson","html_url":"https://github.com/dougwilson","followers_url":"https://api.github.com/users/dougwilson/followers","following_url":"https://api.github.com/users/dougwilson/following{/other_user}","gists_url":"https://api.github.com/users/dougwilson/gists{/gist_id}","starred_url":"https://api.github.com/users/dougwilson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dougwilson/subscriptions","organizations_url":"https://api.github.com/users/dougwilson/orgs","repos_url":"https://api.github.com/users/dougwilson/repos","events_url":"https://api.github.com/users/dougwilson/events{/privacy}","received_events_url":"https://api.github.com/users/dougwilson/received_events","type":"User","site_admin":false},"created_at":"2015-07-20T23:37:42Z","updated_at":"2015-07-20T23:37:42Z","body":"The reason is to close out a CVE that was issued against Express for UTF-7 exploitation. The answer is that yes, you would either need to simply skip using res.json and friends or use a Buffer. We cannot actually change this without the CVE reapplying to our framework (because if you skip it, technically the exploit will only apply to your API, which is out of our control)."}}