Module body_credentials 

Normalizing what the JavaScript SDK actually sends.

The SDK does not speak the REST API the documentation describes. Everything is a POST with a text/plain body, and the method, the credentials and the query parameters all travel inside that body. It does this so a browser never sends a CORS preflight.

Upstream normalizes all of it before routing, in three places:

• allowMethodOverride (middlewares.js:425-433) rewrites the method from _method.
• handleParseHeaders (:111-198) reads _ApplicationId, _JavaScriptKey, _MasterKey, _SessionToken, _InstallationId, _ContentType and friends from the body, and deletes them, which is why a saved Parse object never grows an _ApplicationId field.
• ClassesRouter merges req.body with the decoded query string, so a where sent in the body reaches the same code as one sent in the URL.

Doing all three here, in one layer, is deliberate. Spreading it across the extractor and each route is how a check ends up applied on one path and forgotten on another.

Structs

MethodOverride

The method the client asked for through _method, when it differs from the transport method.

Functions

extract