Express Highlights Summary

Every highlight bullet from the 8 pages in this section, gathered on one page and grouped by the page it came from.

The Express Middleware Pipeline Model

• Express has exactly one core abstraction: an ordered chain of (req, res, next) functions
• req and res are the same objects for the whole chain - middleware mutates shared state, it doesn't isolate it
• A Router is a mountable sub-chain, not an isolated scope - it shares the same prototype extensions as the app
• Express's minimalism is deliberate: almost everything beyond routing and dispatch is left to the ecosystem

Express Basics

• Express 5 is the current major version with native async error handling
• express.json() parses JSON bodies; register it before routes
• Router groups related endpoints with shared middleware
• Route handlers should stay thin; put logic in service functions
• Four-argument error middleware catches thrown and rejected errors
• Use ESM imports with Express 5 on Node 24

Middleware Ordering

• Move body parsers before routes to populate req.body in POST handlers
• Register trust proxy before rate limiting to isolate client IP buckets
• Scope auth middleware to routers not app globally to keep health checks public
• Position error handler last with 4 arguments to catch errors from routes
• Apply security middleware early before routes to protect all responses

Error Handling in Express

• Place 4-argument error middleware after routes to centralize error responses
• Express 5 automatically catches rejected promises from async route handlers
• Use next(err) to skip middleware and jump directly to error handler
• Never send response with res.json() then call next(err)
• Log stack server-side but send generic message to client on 500
• Create AppError class with statusCode for consistent error shapes

Security Middleware

• Helmet sets HTTP headers to mitigate XSS, clickjacking, and MIME sniffing
• CORS with credentials requires exact origins, not wildcard matching
• Use Redis store for rate limiting across multiple pods
• Apply rate limiter after trust proxy for accurate per-IP tracking
• CORS is not authentication, server calls bypass it entirely
• Implement stricter rate limits on auth endpoints to prevent brute force

Express 5 Migration

• Express 5 catches async errors automatically, no try/catch needed
• Wildcard routes changed from app.get('/*') to app.get('/*splat')
• res.send(status) removed; use res.status(n).send() instead
• app.del() and req.param() removed; use app.delete() and req.params
• Run express-async-errors before upgrading from Express 4 to Express 5
• Load test critical paths after upgrading to catch regressions

Performance on Express

• Profile first with clinic.js or 0x; database queries are usually the real bottleneck
• Scale horizontally or use cluster mode instead of micro-optimizing Express overhead
• JSON serialization is a hotspot; pre-serialize cached responses to avoid repeated work
• Tune keep-alive: keepAliveTimeout 65s, headersTimeout 66s, maxConnections 2000
• Avoid sync fs.readFileSync in middleware; blocks the event loop for all connected clients
• Express is fine under 1000 RPS per instance with sub-50ms handlers; team velocity matters

Express Best Practices

• Thin route handlers; business logic in service modules
• Middleware order: trust proxy, security, parsers, auth, routes, errors
• Express 5 for native async error handling
• Centralized error middleware with consistent JSON error shapes
• Scope auth middleware to protected routers, not globally
• Disable x-powered-by and set server timeouts in production

cGJxcnRodnFyZi52YnxwdHZiODA4fDIwMjYwNw==