Middleware

Functions that sit between a request and a response: logging, authentication checks and error handling.

Lesson 9 of 110% of the track complete

What you'll learn

What middleware is, how next() passes control along, how to protect routes, and how a dedicated error handler works in Express.

Why it matters

Many tasks apply to lots of routes: logging, checking a login, parsing bodies, limiting traffic. Middleware lets you write each once and plug it in wherever it is needed, instead of repeating it in every route.

Explanation

Middleware is a function that receives (req, res, next). It can read or change the request, end the response, or call next() to pass control to the next function in the chain.

Order matters: middleware and routes run in the order you register them.

app.use(fn) applies to all routes after it.
You can also attach middleware to one route: app.get("/admin", checkAdmin, handler).
A middleware that stops the chain (by sending a response without calling next()) can reject a request, for example with 401 Unauthorized.
Error-handling middleware has four parameters, (err, req, res, next), and is registered last. Express sends any error thrown in a route to it.

Example

Step-by-step walkthrough

logger runs for every request, prints it and calls next().
/public has no extra middleware, so anyone gets through.
/private has requireKey in front of its handler. Without the x-api-key: secret header, it replies 401 and never reaches the handler.
/boom throws. Express passes the error to the four-argument handler registered last, which logs it and answers 500.
The order is important: the error handler goes after all routes.

Try it yourself

This script starts the server and calls it as a client, so you can see each result. Save as mw.mjs, run npm install express and node mw.mjs.

mw.mjsNode.js

import express from "express";

const app = express();

function logger(req, res, next) {
  console.log("request:", req.method, req.url);
  next();
}

function requireKey(req, res, next) {
  if (req.get("x-api-key") !== "secret") {
    return res.status(401).json({ error: "Unauthorized" });
  }
  next();
}

app.use(logger);
app.get("/public", (req, res) => res.send("Anyone can see this"));
app.get("/private", requireKey, (req, res) => res.send("Secret data"));
app.get("/boom", () => {
  throw new Error("Something broke");
});
app.use((err, req, res, next) => {
  console.log("error handler:", err.message);
  res.status(500).json({ error: "Server error" });
});

Ctrl+Enter to run

Common mistakes

Forgetting to call next(), so the request hangs.
Calling next() after sending a response, which causes an error.
Registering middleware after the routes that need it.
Putting the error handler first, so it never catches anything.

Quick quiz

Question 1 of 3

What does next() do?

Passes control to the next middleware or routeEnds the responseRestarts the server

Question 2 of 3

How many parameters does error-handling middleware have?

Four: err, req, res, nextThreeTwo

Question 3 of 3

Where should the error handler be registered?

After all routesBefore all routesAnywhere

Summary

Middleware has (req, res, next) and calls next() to continue.
Order matters; use it for logging, auth checks and shared work.
Four-argument middleware at the end handles errors.

Next: storing data in a database.

JavaScript

import express from "express";

const app = express();

function logger(req, res, next) {
  console.log("request:", req.method, req.url);
  next();
}

function requireKey(req, res, next) {
  if (req.get("x-api-key") !== "secret") {
    return res.status(401).json({ error: "Unauthorized" });
  }
  next();
}

app.use(logger);

app.get("/public", (req, res) => res.send("Anyone can see this"));
app.get("/private", requireKey, (req, res) => res.send("Secret data"));
app.get("/boom", () => {
  throw new Error("Something broke");
});

app.use((err, req, res, next) => {
  console.log("error handler:", err.message);
  res.status(500).json({ error: "Server error" });
});

app.listen(3000);