Express.js Cheatsheet - Express Middleware & API Reference

An empty req.body is nearly always an ordering problem. app.use(express.json()) must be mounted before any route that reads the body, otherwise the route matches and runs while the body is still unparsed. Likewise req.cookies.token requires cookie-parser() first, and HTML form posts need app.use(express.urlencoded({ extended: true })) to decode application/x-www-form-urlencoded. At the other end, the error handler must come after every route and must declare all four parameters (err, req, res, next), or Express will not recognise it and async errors leave the request hanging. The working order is: parsers, then logging/security (morgan, helmet, cors, compression), then routes, then the 404 fallback, then the error handler.

Express 4 does not automatically catch a rejected Promise returned by an async function; you need one of two bridges. Either use a wrapper — const wrap = (fn) => (req, res, next) => fn(req, res, next).catch(next) — which hands the rejection to next(err) for the global handler (err, req, res, next) => res.status(500).json({ error: err.message }) to render, and write routes as app.post("/users", wrap(async (req, res) => { ... })). Or catch explicitly with try/catch and call next(err). Map validation failures to a non-500 status inside the error handler rather than letting everything be a server error. Keep process.on("uncaughtException", handler) and process.on("unhandledRejection", handler) as the last process-level net.

They map onto five distinct parts of the request. req.params.id comes from the :id placeholder in the path: register app.put("/users/:id", handler) and /users/7 yields "7". req.query.page comes from the query string ?page=2, always a string, and is the usual source for paging and filters. req.body.name comes from the body and requires express.json() or urlencoded() to have parsed it first. req.headers["content-type"] reads a header to branch on content type or spot a token, with req.get("User-Agent") as the ergonomic form. req.cookies.token needs cookie-parser(). The common auth pattern is stripping "Bearer <token>" out of req.headers.authorization and calling jwt.verify(token, secret).

Choose by what the response carries. res.send("hello") emits text with the default Content-Type: text/html and ends the request. res.json({ data }) serialises the object and returns it as application/json — the workhorse for APIs. For creation, chain the status first: res.status(201).json({ ok: true }). res.redirect("/login") issues a 302 and fits login and auth flows. res.sendFile(path.join(__dirname, "index.html")) streams a file straight off disk for static pages or one-click downloads. Set custom headers with res.set("X-Custom", "value"), for instance for cache policy. Server-rendered pages use res.render("index", { title: "Home" }), which resolves templates relative to the directory set by app.set("views", ...).

Split with a Router: create one with const router = express.Router(), mount it with app.use("/api", router), define several methods on one path compactly via router.route("/users").get(list).post(create), and finish with module.exports = router so the entry file can mount it. app.all("/api/*", handler) fits prefix logic such as authentication that must apply to every method. Each middleware has a distinct job: morgan("dev") prints a terse one-line request summary for debugging, helmet() sets a batch of HTTP security headers including X-Content-Type-Options, cors() handles cross-origin with a configurable allowlist, compression() shrinks large JSON and text responses, and express.static("public") serves a directory under a /static prefix so you need no per-file route.