Express & Middleware

// Raw http module: verbose, manual routing
const http = require('node:http');
http.createServer((req, res) => {
  if (req.url === '/users' && req.method === 'GET') { res.end(JSON.stringify(users)); }
}).listen(3000);

// Express: concise, declarative routing
const express = require('express');
const app = express();
app.get('/users', (req, res) => res.json(users));
app.listen(3000);

Common follow-ups: In what scenario might a team deliberately avoid Express and use the raw http module directly instead?;How does Express compare to newer, similarly-purposed frameworks like Fastify or Koa?

app.use(express.json()); // must come before routes that read req.body
app.use(loggingMiddleware); // logs every request
app.use('/admin', requireAuth); // only applies to routes starting with /admin
app.get('/admin/dashboard', (req, res) => res.json(dashboardData)); // protected by the above

Common follow-ups: What happens if a middleware function never calls next() and never sends a response?;How does route-specific middleware (passed as an extra argument to app.get()) differ from application-level middleware registered via app.use()?

const asyncHandler = (fn) => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next);

const checkRateLimit = asyncHandler(async (req, res, next) => {
  const requestCount = await redis.incr(`rate:${req.ip}`);
  if (requestCount > 100) return res.status(429).json({ error: 'Too many requests' });
  next();
});

app.use(checkRateLimit);

Common follow-ups: What happens specifically if this async middleware throws without being wrapped in asyncHandler, in an Express 4 application?;How does this pattern differ once Express 5's native async error handling makes the wrapper largely unnecessary?

// Application-level: every request
app.use(loggingMiddleware);

// Router-level: scoped to this router's routes only
const userRouter = express.Router();
userRouter.use(requireAuth);
userRouter.get('/profile', getProfileHandler);
app.use('/users', userRouter);

// Route-specific: applies only to this one route
app.post('/upload', uploadMiddleware, uploadHandler);

Common follow-ups: How does mounting a router with app.use('/prefix', router) affect the paths defined within that router?;What's the benefit of organizing related routes into separate router modules rather than defining everything directly on the main app object?

const { z } = require('zod');

const createUserSchema = z.object({ email: z.string().email(), age: z.number().min(18) });

function validate(schema) {
  return (req, res, next) => {
    const result = schema.safeParse(req.body);
    if (!result.success) return res.status(400).json({ errors: result.error.issues });
    req.body = result.data;
    next();
  };
}

app.post('/users', validate(createUserSchema), createUserHandler);

Common follow-ups: What's the benefit of validating and transforming data in a single middleware step rather than validating inline within each handler?;How would you handle validating nested or deeply structured request bodies with this same pattern?

app.use(express.json()); // parses JSON bodies
app.use(express.urlencoded({ extended: true })); // parses form submissions

app.post('/users', (req, res) => {
  console.log(req.body); // only populated because the middleware above ran first
});

Common follow-ups: What happens if a client sends a JSON body but express.json() isn't registered -- does the request fail, or does req.body simply stay undefined?;What does the 'extended' option on express.urlencoded() actually control?

app.use((req, res, next) => {
  const start = Date.now();
  res.on('finish', () => {
    const duration = Date.now() - start;
    console.log(`${req.method} ${req.path} ${res.statusCode} ${duration}ms`);
  });
  next();
});

Common follow-ups: Why does logging immediately after calling next() give an incorrect status code and duration compared to listening for 'finish'?;How does this hand-rolled approach compare to using a mature middleware like morgan for the same purpose?

const helmet = require('helmet');
app.use(helmet()); // applies a sensible set of security headers by default

// Customizing a specific header's behavior
app.use(helmet({ contentSecurityPolicy: { directives: { defaultSrc: ["'self'"] } } }));

Common follow-ups: Which of helmet's default headers might need customization for an API serving embeddable widgets meant to be placed in an iframe?;How does Content-Security-Policy specifically help mitigate XSS attacks?

// routes/users.js
const router = express.Router();
router.get('/', listUsers);
router.get('/:id', getUser);
router.post('/', createUser);
module.exports = router;

// app.js
app.use('/api/users', require('./routes/users'));
app.use('/api/orders', require('./routes/orders'));

Common follow-ups: How would you further organize a router module to separate route definitions from their actual handler logic (controllers)?;What's the benefit of this modular structure specifically for a team where multiple developers work on different features simultaneously?

const cors = require('cors');

app.use(cors({
  origin: 'https://myapp.com', // only this origin can call this API from a browser
  methods: ['GET', 'POST'],
  credentials: true,
}));

Common follow-ups: Why does a browser send a preflight OPTIONS request before certain cross-origin requests, and how does the cors middleware handle it?;What's the security risk of configuring CORS with a wildcard '*' origin combined with credentials: true?