Express Routing and Middleware

• Express = thin Node HTTP layer; the app is a function (req, res)
• Each request goes through an ordered stack of middleware and route handlers
• First matching layer runs: it ends the response or calls next()
• If nothing responds, Express returns 404

• express() makes the app; listen(port, cb) starts the server
• res.send() ends the response

• app.set('trust proxy', 1) behind a proxy or load balancer
• Makes req.ip and req.protocol correct
• app.disable('x-powered-by') hides the header

• app.METHOD(path, ...handlers): one verb, one path
• app.all() matches every method
• app.use() matches by path prefix
• app.route('/books').get(list).post(create) chains one path

• Params are strings: use Number(req.params.id)
• Query values are strings or arrays, never numbers
• Optional: Express 4 :id?, Express 5 /users{/:id}
• In Express 5, :id? throws at startup

• Routes match in registration order; first match wins
• router.param runs only for routes on that same router
• Use app.param for routes registered on app

router.param('id', (req, res, next, id) => {
  req.userId = Number(id);
  next();
});
router.get('/users/:id', byId);

routes on the router, not on app

• res.redirect(302, '/login')
• res.set('X-Id', '1') sets a header
• res.cookie('sid', v, { httpOnly: true })
• res.sendFile(absPath) takes an absolute path

• res.locals and req.user carry data between middleware; auth sets req.user
• Ends: send, json, end, redirect, sendFile, sendStatus
• Does not end: set, status, cookie

if (!req.user) {
  return res.status(401).json({ error: 'login' });
}
res.json({ ok: true });

return after responding early

• Signature: (req, res, next)
• Can change req or res
• Can end the response
• Or call next() to pass control on

• app.use(fn): every request
• app.use('/api', fn): only that prefix
• No response and no next() = request hangs
• next(err) skips ahead to error middleware

app.get('/u', async (req, res, next) => {
  try { res.json(await find()) }
  catch (e) { next(e) }
})
app.use((err, req, res, next) => {
  res.status(500).json({ error: 'fail' })
})

four arguments = error handler, registered after all routes

• Forgot next(): request hangs
• next() after responding: second send
• express.json() after routes: req.body is undefined
• Error handler not the last layer

• Body size limit defaults to 100kb; set it with { limit }
• Third-party: npm i, then app.use()

const router = express.Router();
router.use(auth);
router.get('/:id', handler);
module.exports = router;
// app.js
app.use('/users', router);

GET /users/7 reaches router.get('/:id')

• Router paths are relative to the mount point
• router.use(auth) protects only that router
• Inline middleware: app.get('/admin', auth, handler)

• No body parser: req.body is undefined
• Wide-open cors() in production
• Route order: an earlier route shadows the router
• Error handler leaking secrets or stack traces

• req.params.id path, req.query.q URL, req.body.x needs a parser
• Reply with res.status(n).json(obj)
• Every middleware calls next() or responds
• Params are strings; query values are strings or arrays

app.use('/api/users', usersRouter);
app.use((err, req, res, next) => {
  res.status(500).json({ error: 'Oops' });
});

mount a router; error handler takes 4 args

• Parser before routes
• Specific routes before dynamic ones
• return after responding
• Error handler last
• Async errors forwarded to next(err)