Chapter 5 — Middleware Deep Dive

The why

Middleware is the single concept that makes Express usable. If you understand it, every "how do I X in Express" question answers itself.

What middleware actually is

A middleware is a function with three arguments:

function middleware(req, res, next) {
  // do something
  next();
}

That's it. Three rules:

1. Call next() to pass control to the next middleware.
2. Or send a response (res.send, res.json, etc.) — the chain stops.
3. Or call next(err) — passes to the error handler.

Pick exactly one of the three. Picking zero leaves the request hanging.

Where middleware runs

You attach middleware with app.use():

app.use((req, res, next) => {
  console.log(`${req.method} ${req.url}`);
  next();
});

This runs for every request, in the order it was added.

You can scope middleware to a path:

app.use('/api', authMiddleware);   // only /api/*
app.use('/admin', adminOnly);      // only /admin/*

Or to a single route:

app.get('/profile', requireAuth, getProfile);

requireAuth runs first. If it calls next(), getProfile runs.

Writing your first middleware: a logger

module.exports = function logger(req, res, next) {
  const start = Date.now();
  res.on('finish', () => {
    const ms

Why res.on('finish') instead of logging immediately? Because at the start, you don't know the status code yet. The finish event fires when the response is fully sent.

Wire it up:

const logger = require('./middleware/logger');
app.use(logger);

Now every request logs. Free observability.

Writing an auth middleware

const jwt = require('jsonwebtoken');
 
module.exports = function requireAuth(req, res, next) {
  const header = req.headers.authorization;

Notice:

• Reads the token from Authorization: Bearer ....
• Verifies it. If invalid → 401, no next().
• If valid, attaches the user to req.user. The next handler reads req.user.id — clean separation.

Apply it:

app.get('/profile', requireAuth, (req, res) => {
  res.json({ userId: req.user.id });
});

Built-in middleware you'll use daily

Express ships with these:

app.use(express.json({ limit: '1mb' }));           // parse JSON bodies
app.use(express.urlencoded({ extended: true }));   // parse form bodies
app

And these popular ones from npm:

A typical Express app starts with:

const express = require('express');
const cors = require('cors');
const helmet = require('helmet');
const morgan = require('morgan');

Memorize this incantation.

Order matters (a lot)

Middleware runs in the order you attach it. Get the order wrong and you get baffling bugs.

app.get('/profile', getProfile);  // runs without auth
app.use(requireAuth);             // attached too late

getProfile was registered first; the app.use(requireAuth) runs only for routes registered after it. Anyone can hit /profile.

app.use(requireAuth);             // global
app.get('/profile', getProfile);  // now requires auth

Or scope it explicitly:

app.get('/profile', requireAuth, getProfile);  // per-route

Mental model: middleware = a pipeline. Each step sees what previous steps did. Reorder steps, and everything downstream changes.

Error-handling middleware

Express has one special middleware signature: four arguments.

app.use((err, req, res, next) => {
  console.error(err);
  res.status(500).json({ error: 'Internal error' })

The fourth argument is what tells Express this is the error handler. Express only calls it when somewhere upstream did next(err) or threw inside an async wrapped handler.

Critical rule: the error handler must be the last middleware. It catches errors from everything before it.

app.use(express.json());
app.get('/users/:id', userHandler);
// ... all other routes
app.use(notFoundHandler);
app.use(errorHandler);

Async errors — the hidden trap

Express 4 does not catch errors thrown from async handlers by default.

app.get('/users/:id', async (req, res) => {
  const user = await db.users.findById(req.params.id);  // throws

If findById throws, the response is never sent. The request hangs until the client times out.

Two fixes:

Express 5 (RC at the time of writing) auto-catches async errors. If you're on 5, you're set.

Express 4 needs a wrapper:

module.exports = fn => (req, res, next) => {
  Promise.resolve(fn(req, res, next)).catch(next);
};

Then:

const wrap = require('./utils/asyncHandler');
 
app.get('/users/:id', wrap(async (req, res) => {
  const user = await db.users.findById(req

Any thrown error now goes to your error middleware.

A complete example, end to end

const express = require('express');
const helmet = require('helmet');
const cors = require('cors');
const morgan = require('morgan');

That's a small but production-shaped Express app. We'll add validation and a service layer in the next chapters.

Common mistakes

Production · Performance · Security notes

Production. Add a request-ID middleware first thing. Attach the ID to every log line and forward to downstream services.

Performance. Order middleware by cost — cheapest first. A helmet() call is free; a DB lookup is not.

Security. helmet() is non-negotiable. CORS must be explicit. app.set('trust proxy', 1) only when behind a load balancer.

Exercises

1. Beginner. Write a timer middleware that logs request duration.
2. Beginner. Write a requireAdmin middleware that 403s when req.user.role !== 'admin'.
3. Intermediate. Write a request-ID middleware that adds a UUID to req and to a response header.
4. Intermediate. Write an error handler that returns { error, requestId } so users can quote the ID in support tickets.
5. Advanced. Replace the in-process logger with one that ships to a remote service (mock the remote — just buffer).

Interview questions

Beginner. What is middleware? A function with (req, res, next) that runs in the request pipeline. It can read/modify req/res, call next, or send a response.

Senior. How do you handle async errors in Express 4? Wrap async handlers with a Promise.resolve(fn).catch(next) helper.

Summary

Middleware is a function with (req, res, next). It runs in order. It can pass control, send a response, or pass an error. The standard opening — helmet, cors, morgan, json — covers 80% of every app. Order matters. The error handler is last. Async errors need a wrapper in Express 4. Master this and Express has no more surprises for you.

Quick recall

• Middleware = (req, res, next) => { ... }.
• Call next() OR send a response OR next(err).
• Order matters. Auth before protected routes.
• Error handler is last and has 4 args.
• Async errors need a wrapper in Express 4.

Quiz

1. What's the third argument to a middleware function?
2. What goes wrong if a middleware does neither next() nor res.send()?
3. How does Express recognize an error-handling middleware?
4. Why must the error handler come last?
5. How do you catch async errors in Express 4?