🛣️ Routing and Middleware

Routing Basics

A route tells Express: "when a request arrives with this HTTP method at this path, run this function." The shape is always the same:

app.METHOD(PATH, HANDLER);
//  │      │      │
//  │      │      └── (req, res) => { ... } — what to do
//  │      └───────── the URL path, e.g. '/users'
//  └──────────────── get, post, put, patch, delete, ...

Here are the four verbs you'll use most, each mapped to a slice of CRUD (create, read, update, delete):

const express = require('express');
const app = express();
app.use(express.json());

app.get('/users', (req, res) => {          // READ the collection
  res.json([{ id: 1, name: 'Ada' }]);
});

app.post('/users', (req, res) => {         // CREATE
  res.status(201).json({ created: req.body });
});

app.put('/users/:id', (req, res) => {      // UPDATE (full replace)
  res.json({ updated: req.params.id, with: req.body });
});

app.delete('/users/:id', (req, res) => {   // DELETE
  res.status(204).end();                   // 204 = success, no body
});

app.listen(3000, () => console.log('http://localhost:3000'));

Route & Query Parameters

Real routes need to carry data. Express gives you two distinct channels for it, and mixing them up is a classic beginner slip.

Route parameters — req.params

A colon in the path marks a dynamic segment. Whatever the client puts there is captured into req.params. Use these to identify a specific resource.

app.get('/users/:userId/books/:bookId', (req, res) => {
  const { userId, bookId } = req.params;
  res.send(`User ${userId}, Book ${bookId}`);
});

// Request:  GET /users/34/books/8989
// req.params = { userId: '34', bookId: '8989' }   ← always strings

Query parameters — req.query

Everything after the ? in a URL is parsed into req.query. Use these for optional refinements: filtering, sorting, and pagination.

app.get('/products', (req, res) => {
  // Set defaults and convert types — query values are always strings!
  const category = req.query.category;                 // optional
  const page  = Math.max(1, parseInt(req.query.page  || '1', 10));
  const limit = Math.min(100, parseInt(req.query.limit || '10', 10));

  res.json({ category, page, limit });
});

// Request:  GET /products?category=books&page=2&limit=20
// req.query = { category: 'books', page: '2', limit: '20' }

Modular Routes with Router

Piling every route into app.js works until it doesn't. express.Router() is a mini-application you can define routes on, then mount at a base path. It's how you keep a growing app organised by resource.

// routes/users.js — a self-contained router
const express = require('express');
const router = express.Router();

// Paths here are RELATIVE to wherever this router gets mounted:
router.get('/', (req, res) => res.send('List all users'));
router.get('/:id', (req, res) => res.send(`Get user ${req.params.id}`));
router.post('/', (req, res) => res.status(201).send('Create user'));

module.exports = router;

// app.js — mount the router under a base path
const express = require('express');
const app = express();
const userRoutes = require('./routes/users');

app.use('/users', userRoutes);   // router's '/' becomes '/users'
                                 // router's '/:id' becomes '/users/:id'

app.listen(3000);

Mounting at /users means every route inside users.js is automatically prefixed. Add a products.js router the same way and your app stays tidy no matter how many resources you add.

const router = express.Router();
router.use(requireAdmin);            // guards every route below
router.get('/dashboard', showDash);
router.get('/reports', showReports);

What Is Middleware?

A middleware function is any function with the signature (req, res, next) that sits in the request pipeline. Each one can read or modify the request and response, and then either pass control onward with next() or end the cycle by sending a response.

function myMiddleware(req, res, next) {
  // 1. Do some work (log, parse, check auth, attach data...)
  console.log(`${req.method} ${req.url}`);

  // 2a. Pass control to the next function in the pipeline:
  next();

  // 2b. ...OR end the cycle instead of calling next():
  // res.status(401).send('Not allowed');
}

Here's the whole request lifecycle as a pipeline — the diagram worth memorising:

Kinds of Middleware

1. Built-in middleware

Express ships three you'll use constantly — no installs needed:

app.use(express.json());                          // parse JSON bodies → req.body
app.use(express.urlencoded({ extended: true }));  // parse HTML form bodies → req.body
app.use(express.static('public'));                // serve files from ./public

2. Custom middleware

Write your own for anything cross-cutting. A request logger is the classic first example:

// A logger that also stamps each request with a timestamp
function requestLogger(req, res, next) {
  req.requestTime = new Date().toISOString();
  console.log(`[${req.requestTime}] ${req.method} ${req.originalUrl}`);
  next();   // don't forget this, or the request hangs!
}

app.use(requestLogger);   // runs for every request

Middleware can also guard a single route — just pass it before the handler:

function requireApiKey(req, res, next) {
  if (req.get('X-API-Key') !== process.env.API_KEY) {
    return res.status(401).json({ error: 'Invalid API key' });
  }
  next();   // key is valid — carry on
}

// Only /admin is protected; other routes are untouched:
app.get('/admin', requireApiKey, (req, res) => {
  res.json({ secret: 'the launch codes' });
});

3. Third-party middleware

The ecosystem is Express's superpower. Install a package and app.use() it:

const morgan = require('morgan');
const helmet = require('helmet');
const cors = require('cors');

app.use(helmet());        // sensible security headers
app.use(cors());          // allow cross-origin requests
app.use(morgan('dev'));   // concise coloured request logs

Error-Handling Middleware

Error handlers are special: they take four arguments, (err, req, res, next). Express recognises the extra err parameter and routes errors to them. They belong last, after all routes.

// A route that deliberately fails — pass the error to next():
app.get('/boom', (req, res, next) => {
  const err = new Error('Something broke');
  err.statusCode = 400;
  next(err);            // hands off to the error handler below
});

// The error handler — note the FOUR parameters:
app.use((err, req, res, next) => {
  console.error(err.stack);
  const status = err.statusCode || 500;
  res.status(status).json({
    error: err.message || 'Internal Server Error'
  });
});

app.get('/users/:id', async (req, res, next) => {
  try {
    const user = await db.findUser(req.params.id);
    if (!user) return res.status(404).json({ error: 'Not found' });
    res.json(user);
  } catch (err) {
    next(err);   // sends it to the error-handling middleware
  }
});

Pair the error handler with a catch-all 404 for routes that matched nothing:

// 404 — after all real routes, before the error handler:
app.use((req, res) => {
  res.status(404).json({ error: `No route for ${req.method} ${req.originalUrl}` });
});

Middleware Order

Because middleware runs top-to-bottom in the order you register it, ordering is not a style choice — it's correctness. This is the canonical arrangement:

const app = express();

// 1. Security & logging — first, so they cover everything
app.use(helmet());
app.use(morgan('dev'));

// 2. Body parsing — before any route that reads req.body
app.use(express.json());
app.use(express.urlencoded({ extended: true }));

// 3. Static files
app.use(express.static('public'));

// 4. Your application routes
app.use('/api/users', userRoutes);
app.use('/api/products', productRoutes);

// 5. Catch-all 404 — after every real route
app.use((req, res) => {
  res.status(404).json({ error: 'Route not found' });
});

// 6. Error handler — the very last thing
app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(500).json({ error: 'Internal server error' });
});

// 🐛 BUG: nothing happens when the condition is false
app.use((req, res, next) => {
  if (req.headers.authorization) next();
  // else... the request just hangs
});

// ✅ FIX: always resolve one way or the other
app.use((req, res, next) => {
  if (req.headers.authorization) return next();
  res.status(401).send('Authorization required');
});

Practice & Quiz

// routes/posts.js
const express = require('express');
const router = express.Router();

let posts = [{ id: 1, title: 'Hello' }];

router.get('/', (req, res) => res.json(posts));

router.get('/:id', (req, res) => {
  const post = posts.find(p => p.id === Number(req.params.id));
  if (!post) return res.status(404).json({ error: 'Post not found' });
  res.json(post);
});

router.post('/', (req, res) => {
  const { title } = req.body;
  if (!title) return res.status(400).json({ error: 'title is required' });
  const post = { id: posts.length + 1, title };
  posts.push(post);
  res.status(201).json(post);
});

module.exports = router;

// app.js
const express = require('express');
const app = express();
app.use(express.json());
app.use('/api/posts', require('./routes/posts'));
app.listen(3000, () => console.log('http://localhost:3000'));

function timing(req, res, next) {
  const start = Date.now();
  res.on('finish', () => {
    const ms = Date.now() - start;
    console.log(`${req.method} ${req.originalUrl} → ${res.statusCode} (${ms}ms)`);
  });
  next();
}

app.use(timing);

Best Practices & Pitfalls

✅ Do

• Split routes into express.Router modules, one per resource
• Register body parsers and security middleware before your routes
• Validate and type-convert everything from req.params and req.query
• Give every request path exactly one ending: a next() or a response
• Put the 404 handler after routes, and the four-argument error handler dead last
• Forward async errors with try/catch and next(err)

❌ Don't

• Define the error handler before your routes — it won't catch them
• Trust query/route values without validating them (they're user input)
• Use a GET route to change data — that's what POST/PUT/DELETE are for
• Forget next() in a pass-through middleware

Error: Cannot set headers after they are sent to the client

Summary

📚 Additional Resources

• Express — Routing guide
• Express — Using middleware
• Express — Writing middleware
• Express — Error handling

🚀 What's Next?

You can now route requests and shape the pipeline they flow through. Next we zoom in on the two objects every handler receives — reading everything the client sent and crafting exactly the reply you want — in Request and Response Objects.