diff --git a/lib/cartodb/controllers/base.js b/lib/cartodb/controllers/base.js
index 07758977..2986f97e 100644
--- a/lib/cartodb/controllers/base.js
+++ b/lib/cartodb/controllers/base.js
@@ -7,8 +7,6 @@ function BaseController(authApi, pgConnection) {
 
 module.exports = BaseController;
 
-// jshint maxcomplexity:6
-
 // jshint maxcomplexity:9
 BaseController.prototype.send = function(req, res, body, status, headers) {
     if (req.params.dbhost) {
diff --git a/lib/cartodb/middleware/lzma.js b/lib/cartodb/middleware/lzma.js
new file mode 100644
index 00000000..d58f16cc
--- /dev/null
+++ b/lib/cartodb/middleware/lzma.js
@@ -0,0 +1,30 @@
+'use strict';
+
+var LZMA = require('lzma').LZMA;
+
+var lzmaWorker = new LZMA();
+
+module.exports = function lzmaMiddleware(req, res, next) {
+    if (!req.query.hasOwnProperty('lzma')) {
+        return next();
+    }
+
+    // Decode (from base64)
+    var lzma = new Buffer(req.query.lzma, 'base64')
+        .toString('binary')
+        .split('')
+        .map(function(c) {
+            return c.charCodeAt(0) - 128;
+        });
+
+    // Decompress
+    lzmaWorker.decompress(lzma, function(result) {
+        try {
+            delete req.query.lzma;
+            Object.assign(req.query, JSON.parse(result));
+            next();
+        } catch (err) {
+            next(new Error('Error parsing lzma as JSON: ' + err));
+        }
+    });
+};
diff --git a/lib/cartodb/server.js b/lib/cartodb/server.js
index f3e88107..a9ade8bb 100644
--- a/lib/cartodb/server.js
+++ b/lib/cartodb/server.js
@@ -4,6 +4,8 @@ var RedisPool = require('redis-mpool');
 var cartodbRedis = require('cartodb-redis');
 var _ = require('underscore');
 
+var lzmaMiddleware = require('./middleware/lzma');
+
 var controller = require('./controllers');
 
 var SurrogateKeysCache = require('./cache/surrogate_keys_cache');
@@ -368,6 +370,8 @@ function bootstrap(opts) {
         next();
     });
 
+    app.use(lzmaMiddleware);
+
     // temporary measure until we upgrade to newer version expressjs so we can check err.status
     app.use(function(err, req, res, next) {
         if (err) {
diff --git a/test/unit/cartodb/lzmaMiddleware.test.js b/test/unit/cartodb/lzmaMiddleware.test.js
new file mode 100644
index 00000000..9a41030a
--- /dev/null
+++ b/test/unit/cartodb/lzmaMiddleware.test.js
@@ -0,0 +1,36 @@
+var assert = require('assert');
+var testHelper = require('../../support/test_helper');
+
+var lzmaMiddleware = require('../../../lib/cartodb/middleware/lzma');
+
+describe('lzma-middleware', function() {
+
+    it('it should extend params with decoded lzma', function(done) {
+        var qo = {
+            config: {
+                version: '1.3.0'
+            }
+        };
+        testHelper.lzma_compress_to_base64(JSON.stringify(qo), 1, function(err, data) {
+            var req = {
+                headers: {
+                    host:'localhost'
+                },
+                query: {
+                    api_key: 'test',
+                    lzma: data
+                }
+            };
+            lzmaMiddleware(req, {}, function(err) {
+                if ( err ) {
+                    return done(err);
+                }
+                var query = req.query;
+                assert.deepEqual(qo.config, query.config);
+                assert.equal('test', query.api_key);
+                done();
+            });
+        });
+    });
+
+});
diff --git a/test/unit/cartodb/req2params.test.js b/test/unit/cartodb/req2params.test.js
index cd067254..05e1f262 100644
--- a/test/unit/cartodb/req2params.test.js
+++ b/test/unit/cartodb/req2params.test.js
@@ -1,6 +1,6 @@
 var assert = require('assert');
 var _ = require('underscore');
-var test_helper = require('../../support/test_helper');
+require('../../support/test_helper');
 
 var RedisPool = require('redis-mpool');
 var cartodbRedis = require('cartodb-redis');
@@ -101,10 +101,19 @@ describe('req2params', function() {
       });
     });
 
-    it('it should extend params with decoded lzma', function(done) {
-        var qo = {
-            config: {
-                version: '1.3.0'
+    it('it should remove invalid params', function(done) {
+        var config = {
+            version: '1.3.0'
+        };
+        var req = {
+            headers: {
+                host:'localhost'
+            },
+            query: {
+                non_included: 'toberemoved',
+                api_key: 'test',
+                style: 'override',
+                config: config
             }
         };
         test_helper.lzma_compress_to_base64(JSON.stringify(qo), 1, function(err, data) {
@@ -130,6 +139,7 @@ describe('req2params', function() {
                 assert.equal(undefined, query.non_included);
                 done();
             });
+
         });
     });