Express Middleware Patterns

Express middleware provides powerful request processing. Here's how to use and create middleware effectively.

Middleware Basics#

import express, { Request, Response, NextFunction } from 'express';

const app = express();

// Simple middleware
function logger(req: Request, res: Response, next: NextFunction) {
  console.log(`${req.method} ${req.url}`);
  next();
}

// Apply to all routes
app.use(logger);

// Apply to specific path
app.use('/api', logger);

// Apply to specific route
app.get('/users', logger, (req, res) => {
  res.json({ users: [] });
});

// Middleware factory
function delayMiddleware(ms: number) {
  return (req: Request, res: Response, next: NextFunction) => {
    setTimeout(next, ms);
  };
}

app.use(delayMiddleware(100));

Request Processing Chain#

// Order matters - middleware runs sequentially
app.use(express.json());           // 1. Parse JSON body
app.use(express.urlencoded());     // 2. Parse URL-encoded body
app.use(cors());                   // 3. Handle CORS
app.use(helmet());                 // 4. Security headers
app.use(morgan('combined'));       // 5. Request logging
app.use(authMiddleware);           // 6. Authentication
app.use('/api', rateLimiter);      // 7. Rate limiting
app.use('/api', routes);           // 8. Route handlers
app.use(errorHandler);             // 9. Error handling (last)

// Response modification
function addHeaders(req: Request, res: Response, next: NextFunction) {
  res.setHeader('X-Request-Id', generateId());
  res.setHeader('X-Response-Time', '');

  const start = Date.now();

  res.on('finish', () => {
    const duration = Date.now() - start;
    console.log(`Request took ${duration}ms`);
  });

  next();
}

Authentication Middleware#

import jwt from 'jsonwebtoken';

interface AuthRequest extends Request {
  user?: {
    id: string;
    email: string;
    role: string;
  };
}

async function authenticate(
  req: AuthRequest,
  res: Response,
  next: NextFunction
) {
  const authHeader = req.headers.authorization;

  if (!authHeader?.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'No token provided' });
  }

  const token = authHeader.slice(7);

  try {
    const payload = jwt.verify(token, process.env.JWT_SECRET!) as {
      userId: string;
      email: string;
      role: string;
    };

    req.user = {
      id: payload.userId,
      email: payload.email,
      role: payload.role,
    };

    next();
  } catch (error) {
    return res.status(401).json({ error: 'Invalid token' });
  }
}

// Role-based authorization
function authorize(...allowedRoles: string[]) {
  return (req: AuthRequest, res: Response, next: NextFunction) => {
    if (!req.user) {
      return res.status(401).json({ error: 'Not authenticated' });
    }

    if (!allowedRoles.includes(req.user.role)) {
      return res.status(403).json({ error: 'Forbidden' });
    }

    next();
  };
}

// Usage
app.get('/admin', authenticate, authorize('admin'), (req, res) => {
  res.json({ message: 'Admin area' });
});

app.get('/profile', authenticate, (req: AuthRequest, res) => {
  res.json({ user: req.user });
});

Validation Middleware#

import { z } from 'zod';

function validate<T>(schema: z.ZodType<T>) {
  return (req: Request, res: Response, next: NextFunction) => {
    try {
      req.body = schema.parse(req.body);
      next();
    } catch (error) {
      if (error instanceof z.ZodError) {
        return res.status(400).json({
          error: 'Validation failed',
          issues: error.issues.map((issue) => ({
            path: issue.path.join('.'),
            message: issue.message,
          })),
        });
      }
      next(error);
    }
  };
}

const createUserSchema = z.object({
  email: z.string().email(),
  password: z.string().min(8),
  name: z.string().min(2),
});

app.post('/users', validate(createUserSchema), async (req, res) => {
  // req.body is validated and typed
  const user = await createUser(req.body);
  res.status(201).json(user);
});

// Query validation
function validateQuery<T>(schema: z.ZodType<T>) {
  return (req: Request, res: Response, next: NextFunction) => {
    try {
      req.query = schema.parse(req.query) as any;
      next();
    } catch (error) {
      if (error instanceof z.ZodError) {
        return res.status(400).json({ error: 'Invalid query parameters' });
      }
      next(error);
    }
  };
}

Error Handling Middleware#

// Custom error class
class AppError extends Error {
  constructor(
    public statusCode: number,
    public message: string,
    public code?: string
  ) {
    super(message);
    this.name = 'AppError';
  }
}

// Async error wrapper
function asyncHandler(
  fn: (req: Request, res: Response, next: NextFunction) => Promise<any>
) {
  return (req: Request, res: Response, next: NextFunction) => {
    Promise.resolve(fn(req, res, next)).catch(next);
  };
}

// Usage
app.get('/users/:id', asyncHandler(async (req, res) => {
  const user = await db.users.findUnique({ where: { id: req.params.id } });

  if (!user) {
    throw new AppError(404, 'User not found', 'USER_NOT_FOUND');
  }

  res.json(user);
}));

// Global error handler (must have 4 parameters)
function errorHandler(
  error: Error,
  req: Request,
  res: Response,
  next: NextFunction
) {
  console.error('Error:', error);

  if (error instanceof AppError) {
    return res.status(error.statusCode).json({
      error: error.message,
      code: error.code,
    });
  }

  if (error instanceof z.ZodError) {
    return res.status(400).json({
      error: 'Validation error',
      issues: error.issues,
    });
  }

  // Default error response
  res.status(500).json({
    error: process.env.NODE_ENV === 'production'
      ? 'Internal server error'
      : error.message,
  });
}

// Must be last
app.use(errorHandler);

Request Logging#

import morgan from 'morgan';

// Predefined formats
app.use(morgan('combined')); // Apache combined format
app.use(morgan('dev'));      // Colored dev format

// Custom format
morgan.token('body', (req: Request) => JSON.stringify(req.body));

app.use(morgan(':method :url :status :response-time ms - :body'));

// Custom logger middleware
function requestLogger(req: Request, res: Response, next: NextFunction) {
  const start = Date.now();
  const requestId = crypto.randomUUID();

  // Add request ID to request and response
  req.headers['x-request-id'] = requestId;
  res.setHeader('x-request-id', requestId);

  res.on('finish', () => {
    const duration = Date.now() - start;

    console.log(JSON.stringify({
      requestId,
      method: req.method,
      url: req.url,
      status: res.statusCode,
      duration,
      userAgent: req.headers['user-agent'],
      ip: req.ip,
    }));
  });

  next();
}

Caching Middleware#

import NodeCache from 'node-cache';

const cache = new NodeCache({ stdTTL: 300 });

function cacheResponse(ttlSeconds: number = 300) {
  return (req: Request, res: Response, next: NextFunction) => {
    if (req.method !== 'GET') {
      return next();
    }

    const key = req.originalUrl;
    const cached = cache.get(key);

    if (cached) {
      res.setHeader('X-Cache', 'HIT');
      return res.json(cached);
    }

    // Override res.json to cache response
    const originalJson = res.json.bind(res);

    res.json = (body: any) => {
      cache.set(key, body, ttlSeconds);
      res.setHeader('X-Cache', 'MISS');
      return originalJson(body);
    };

    next();
  };
}

// Usage
app.get('/products', cacheResponse(600), async (req, res) => {
  const products = await db.products.findMany();
  res.json(products);
});

// Cache invalidation
function invalidateCache(pattern: string) {
  const keys = cache.keys();
  const matchingKeys = keys.filter((key) => key.includes(pattern));
  cache.del(matchingKeys);
}

app.post('/products', async (req, res) => {
  const product = await db.products.create({ data: req.body });
  invalidateCache('/products');
  res.status(201).json(product);
});

Composition Patterns#

// Combine multiple middlewares
function compose(...middlewares: express.RequestHandler[]) {
  return (req: Request, res: Response, next: NextFunction) => {
    const dispatch = (index: number): void => {
      if (index === middlewares.length) {
        return next();
      }

      const middleware = middlewares[index];
      middleware(req, res, (err) => {
        if (err) return next(err);
        dispatch(index + 1);
      });
    };

    dispatch(0);
  };
}

// Usage
const apiMiddleware = compose(
  authenticate,
  rateLimiter({ max: 100 }),
  requestLogger
);

app.use('/api', apiMiddleware);

Best Practices#

Organization:
✓ Keep middleware focused
✓ Use middleware factories
✓ Order middleware correctly
✓ Handle async errors

Performance:
✓ Keep middleware lightweight
✓ Cache when appropriate
✓ Avoid blocking operations
✓ Use streaming for large responses

Security:
✓ Validate all inputs
✓ Use helmet for headers
✓ Implement rate limiting
✓ Log security events

Express middleware enables clean, modular request processing. Use factories for configurable middleware, async handlers for error propagation, and proper ordering for correct execution. Well-designed middleware keeps route handlers focused on business logic.