HTTP Fundamentals Highlights Summary

Every highlight bullet from the 8 pages in this section, gathered on one page and grouped by the page it came from.

The Node.js HTTP Server Model

• Every Node framework wraps the same http.Server request listener - none of them replace it
• IncomingMessage and ServerResponse are streams first, request/response objects second
• A TCP connection can carry many requests; a request is not the same thing as a connection
• Headers are either buffered or sent immediately - mixing writeHead and setHeader after writes throws

HTTP Basics in Node

• Node's http module is the foundation every framework builds on
• IncomingMessage is the request; ServerResponse is the response
• Always set Content-Type and end the response or connections hang
• Use req.url and req.method for routing before reaching for Express
• Set server timeouts to prevent slow-client connection exhaustion
• Stream large responses with createReadStream instead of loading into memory

Routing Without Frameworks

• Use plain HTTP routing for services under 10 endpoints to avoid framework dependency weight
• Parse pathname with URL before route matching to handle query strings correctly
• Switch to a framework router past 20 routes as O(n) linear matching becomes slow
• Collect req chunks manually and parse JSON for POST bodies in raw HTTP
• Return 405 with Allow header when method not in ALLOWED set at boundary
• Frameworks add trie-based routers middleware chains and param coercion over plain HTTP

Middleware Pattern

• Order middleware: parsers first, context/auth middle, error handlers last
• Return immediately after res.send() to avoid ERR_HTTP_HEADERS_SENT crashes
• Every code path must call next() or end response; omitting next() hangs requests
• Error middleware needs 4-parameter signature (err, req, res, next) to catch errors
• Middleware chains each function through next(), mutating req/res as they pass through
• Fastify uses hooks instead of middleware chains; NestJS uses guards and interceptors

Keep-Alive & Connection Limits

• Set keepAliveTimeout 5-10s below proxy timeout to prevent 502s during rolling deploys
• Node headersTimeout must exceed keepAliveTimeout to avoid mid-header connection destruction
• Align server keepAliveTimeout with proxy timeout to prevent RST errors from socket disagreement
• Use module-level HTTP Agent with keepAlive true to reuse connections and prevent FD exhaustion
• Cap maxSockets per host at 50-100 to prevent downstream services from exhausting file descriptors
• Set server.maxConnections and handle drop events to prevent accept queue overflow under load

Reverse Proxy Awareness

• Trust proxy tells Express to read X-Forwarded-* headers from trusted proxies only
• Without trust proxy, rate limiters see proxy IP instead of real client IP
• trust proxy true is unsafe on public internet; restrict to known proxy IPs only
• req.secure is false behind TLS-terminating proxy; use trust proxy with X-Forwarded-Proto
• Exempt health check endpoints from rate limiting to prevent IP bucket collision
• X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Host carry client metadata

HTTP/2 & HTTP/3 Considerations

• Terminate HTTP/2 and HTTP/3 at reverse proxy for simpler cert management and protocol upgrades
• HTTP/2 multiplexes many requests over one TCP connection improving throughput
• HTTP/3 uses QUIC over UDP for faster connection setup and better mobile performance
• Use gRPC-Web or h2 target group when gRPC requires HTTP/2 end-to-end
• Avoid enabling HTTP/2 in Node behind proxy without gRPC to reduce cert management overhead
• HTTP/2 push is deprecated in browsers avoid building features on it

HTTP Fundamentals Best Practices

• Set server and client timeouts before production traffic
• Align keepAliveTimeout below your reverse proxy idle timeout
• Trust proxy only for known hop counts or IP ranges
• Parse bodies with size limits; never buffer unbounded streams
• Terminate TLS and HTTP/2 at the edge unless gRPC requires otherwise
• Health checks on a separate path or port from authenticated routes