Chapter 12: Express.js

Build web servers in minutes, not hours — Express.js is the most popular Node.js framework for building APIs and web apps.

What is Express?

Routes

Middleware

Request & Response

Error Handling

Quiz

What is Express?

If Node.js is like having a plot of land, Express is like having a pre-built house frame on that land. You could build everything from scratch with raw Node.js (like building a house brick by brick), but Express gives you the walls, doors, and plumbing already in place. You just decorate (add your routes and logic).

Express simplifies everything about building a server:

Routing — Define URL patterns easily (no giant if/else chains)
Middleware — Plug in reusable processing steps
Request parsing — Automatically parse JSON, form data, URL params
Error handling — Centralized error management

Express vs Raw Node.js

Comparison — Raw Node vs Express

// ===== RAW NODE.JS (hard way) =====
const http = require('http');
const server = http.createServer((req, res) => {
  if (req.url === '/api/users' && req.method === 'GET') {
    res.writeHead(200, { 'Content-Type': 'application/json' });
    res.end(JSON.stringify([{ name: 'Rahul' }]));
  } else if (req.url === '/api/users' && req.method === 'POST') {
    // Must manually parse body... painful!
    let body = '';
    req.on('data', chunk => body += chunk);
    req.on('end', () => {
      const data = JSON.parse(body);
      res.writeHead(201, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify(data));
    });
  }
});


// ===== EXPRESS (easy way) =====
const express = require('express');
const app = express();
app.use(express.json());  // Automatically parses JSON bodies!

app.get('/api/users', (req, res) => {
  res.json([{ name: 'Rahul' }]);       // So much cleaner!
});

app.post('/api/users', (req, res) => {
  res.status(201).json(req.body);       // Body is already parsed!
});

Setting Up Express

server.js — Basic Express Setup

const express = require('express');
const cors = require('cors');
require('dotenv').config();    // Load .env variables

const app = express();

// Built-in middleware
app.use(express.json());       // Parse JSON request bodies
app.use(cors());               // Allow cross-origin requests (React on :3000 -> API on :5000)

// A simple test route
app.get('/', (req, res) => {
  res.json({ message: 'API is running!' });
});

// Start server
const PORT = process.env.PORT || 5000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});

// Run: node server.js
// Visit: http://localhost:5000

Routes

Routes are like doors in a building. Each door (URL) leads to a different room (function). The front door (/) takes you to the lobby. The door labeled "Users" (/api/users) takes you to the user management room. Express lets you label these doors clearly.

Basic Routes

Express — Basic Routes

// app.METHOD(PATH, HANDLER)
// METHOD = get, post, put, delete
// PATH = the URL pattern
// HANDLER = function that runs when this route is hit

const express = require('express');
const app = express();
app.use(express.json());

// GET all users
app.get('/api/users', (req, res) => {
  res.json([{ id: 1, name: 'Rahul' }, { id: 2, name: 'Priya' }]);
});

// GET one user by ID (dynamic parameter)
app.get('/api/users/:id', (req, res) => {
  const userId = req.params.id;   // :id becomes req.params.id
  res.json({ id: userId, name: 'Rahul' });
});

// POST create a new user
app.post('/api/users', (req, res) => {
  const { name, email } = req.body;  // Data sent from the client
  res.status(201).json({ id: 3, name, email });
});

// DELETE a user
app.delete('/api/users/:id', (req, res) => {
  res.json({ message: `User ${req.params.id} deleted` });
});

Route Organization with Router

As your app grows, you split routes into separate files using express.Router():

routes/userRoutes.js — Organized Routes

// ===== routes/userRoutes.js =====
const express = require('express');
const router = express.Router();

// All routes here are relative to /api/users
router.get('/', (req, res) => {
  // This handles GET /api/users
  res.json([{ id: 1, name: 'Rahul' }]);
});

router.get('/:id', (req, res) => {
  // This handles GET /api/users/42
  res.json({ id: req.params.id, name: 'Rahul' });
});

router.post('/', (req, res) => {
  // This handles POST /api/users
  res.status(201).json(req.body);
});

module.exports = router;


// ===== server.js (main file) =====
const express = require('express');
const userRoutes = require('./routes/userRoutes');

const app = express();
app.use(express.json());

// Mount the router — all routes prefixed with /api/users
app.use('/api/users', userRoutes);

Rule of thumb: One router file per resource. userRoutes.js handles all user-related endpoints, taskRoutes.js handles tasks, etc. This keeps your server.js clean and organized.

Middleware

Middleware is like security checkpoints at an airport. Before you reach your gate (the route handler), you pass through multiple checkpoints: ticket check, ID verification, baggage scan. Each checkpoint can let you through, stop you, or add something to your boarding pass. Middleware works the same way — each function runs before your route handler.

Express — Middleware

const express = require('express');
const app = express();

// ===== BUILT-IN MIDDLEWARE =====
app.use(express.json());          // Parse JSON bodies
app.use(express.urlencoded({ extended: true })); // Parse form data

// ===== CUSTOM MIDDLEWARE — runs for EVERY request =====
app.use((req, res, next) => {
  console.log(`${new Date().toISOString()} ${req.method} ${req.url}`);
  next();  // MUST call next() to continue to the next middleware/route!
});

// ===== AUTH MIDDLEWARE — reusable function =====
function authenticate(req, res, next) {
  const token = req.headers.authorization;

  if (!token) {
    return res.status(401).json({ message: 'No token provided' });
    // Notice: NO next() here — we STOP the request
  }

  // In real app, verify the token here
  req.user = { id: 1, name: 'Rahul' };  // Attach user info to request
  next();  // Token is valid, continue!
}

// ===== USING MIDDLEWARE ON SPECIFIC ROUTES =====
// Public route — no middleware
app.get('/api/public', (req, res) => {
  res.json({ message: 'Anyone can see this' });
});

// Protected route — authenticate middleware runs FIRST
app.get('/api/profile', authenticate, (req, res) => {
  // If we get here, authenticate already verified the token
  // and attached req.user
  res.json({ message: 'Protected!', user: req.user });
});

// Protected route group — middleware for all routes below
app.use('/api/tasks', authenticate);  // All /api/tasks routes need auth
app.get('/api/tasks', (req, res) => {
  res.json({ tasks: [], user: req.user });
});

Middleware Flow:

Request → express.json() → logger → authenticate → Route Handler → Response

Each middleware calls next() to pass to the next one, or sends a response to stop the chain.

Forgetting next() is a common bug! If your middleware doesn't call next() or send a response, the request will hang forever. The client will wait and eventually timeout.

Request & Response

Every route handler receives two objects: req (what the client sent) and res (what you send back).

The Request Object (req)

Express — Request Object

// For this request:
// POST /api/users/42?role=admin&active=true
// Headers: { Authorization: 'Bearer token123' }
// Body: { "name": "Rahul", "email": "rahul@example.com" }

app.post('/api/users/:id', (req, res) => {

  req.params.id;          // "42" — from the URL pattern (:id)

  req.query.role;         // "admin" — from ?role=admin
  req.query.active;       // "true" — from &active=true (always strings!)

  req.body.name;          // "Rahul" — from the JSON body
  req.body.email;         // "rahul@example.com"

  req.headers.authorization; // "Bearer token123"

  req.method;             // "POST"
  req.url;                // "/api/users/42?role=admin&active=true"

  // Summary:
  // req.params  = URL parameters (:id, :slug)
  // req.query   = Query string (?key=value)
  // req.body    = POST/PUT data (JSON body)
  // req.headers = HTTP headers
});

The Response Object (res)

Express — Response Object

app.get('/api/example', (req, res) => {

  // Send JSON (most common for APIs)
  res.json({ name: 'Rahul', age: 25 });

  // Set status code + send JSON
  res.status(201).json({ message: 'Created!' });

  // Send an error
  res.status(404).json({ message: 'User not found' });
  res.status(500).json({ message: 'Server error' });

  // Send plain text
  res.send('Hello World');

  // Redirect
  res.redirect('/login');

  // IMPORTANT: You can only send ONE response per request!
  // Calling res.json() twice will cause an error
});

Error Handling

Error handling is like having a safety net under a tightrope. Things will go wrong — invalid data, missing records, database failures. Instead of letting your app crash, you catch errors gracefully and send helpful messages to the client.

Express — Error Handling

// ===== TRY/CATCH in route handlers =====
app.get('/api/users/:id', async (req, res, next) => {
  try {
    const user = await User.findByPk(req.params.id);

    if (!user) {
      return res.status(404).json({ message: 'User not found' });
    }

    res.json(user);
  } catch (err) {
    next(err);  // Pass error to the error handler
  }
});

// ===== ASYNC WRAPPER (DRY pattern) =====
// Instead of writing try/catch in every route:
const asyncHandler = (fn) => (req, res, next) => {
  Promise.resolve(fn(req, res, next)).catch(next);
};

// Now routes are cleaner:
app.get('/api/users', asyncHandler(async (req, res) => {
  const users = await User.findAll();
  res.json(users);
  // If this throws, asyncHandler catches it automatically!
}));


// ===== CENTRALIZED ERROR HANDLER =====
// This MUST be the LAST app.use() — after all routes
// It has 4 parameters (err, req, res, next) — that's how Express knows it's an error handler

app.use((err, req, res, next) => {
  console.error('Error:', err.message);

  // Default to 500 if no status was set
  const status = err.status || 500;
  const message = err.message || 'Internal Server Error';

  res.status(status).json({
    error: {
      message: message,
      // Only show stack trace in development
      ...(process.env.NODE_ENV === 'development' && { stack: err.stack }),
    },
  });
});

The error handler MUST have 4 parameters: (err, req, res, next). Even if you don't use next, you must include it. That's how Express distinguishes error handlers from regular middleware.

The asyncHandler pattern saves you from writing try/catch in every single route. It's a wrapper that catches any thrown error and passes it to your centralized error handler. Most production Express apps use this pattern.

📝 Chapter 12 Quiz

1. What is Express.js?

A database

A web framework for Node.js

A frontend library like React

A testing tool

2. In the route /api/users/:id, how do you access the id?

req.body.id

req.query.id

req.params.id

req.id

3. What does next() do in middleware?

Passes control to the next middleware/route

Sends a response to the client

Restarts the server

Closes the database connection

4. What does app.use(express.json()) do?

Sends JSON responses

Converts HTML to JSON

Creates a JSON database

Parses incoming JSON request bodies

5. How many parameters does an Express error handler need?

2 (req, res)

4 (err, req, res, next)

3 (req, res, next)

1 (err)

← Chapter 11: Node.js Fundamentals Chapter 13: Sequelize ORM →