Middleware sits between incoming requests and your route handlers. It intercepts requests, does something with them, and either passes them along or stops them. Understanding middleware is key to building Express applications.
What Is Middleware?
Middleware is a function that has access to the request and response objects. It can modify them, perform checks, or stop the request.
Think of middleware as checkpoints in an airport:
Security check (middleware validates the request)
Baggage scan (middleware processes data)
Gate (final destination/route handler)
Each checkpoint can allow you through to the next, or stop you.
In Express, middleware functions have this signature:
function middleware(req, res, next) {
// Do something
next(); // Pass to next middleware
}
The next() function passes control to the next middleware or route handler.
How Middleware Works
When a request arrives, Express processes it through middleware in order:
Request comes in
|
v
Middleware 1 (if next() called, continue)
|
v
Middleware 2 (if next() called, continue)
|
v
Route Handler (your actual route)
|
v
Response sent
Each middleware either calls next() to continue or sends a response to stop.
Using Express-Provided Middleware
Express provides built-in middleware for common tasks:
import express from 'express';
const app = express();
// Parse JSON requests
app.use(express.json());
// Parse URL-encoded form data
app.use(express.urlencoded({ extended: true }));
// Serve static files
app.use(express.static('public'));
app.post('/data', (req, res) => {
// Thanks to express.json() middleware, req.body is parsed
console.log(req.body);
res.send('Data received');
});
app.listen(3000);
express.json() middleware automatically parses incoming JSON and populates req.body.
Creating Custom Middleware
Write your own middleware for custom logic:
import express from 'express';
const app = express();
// Custom logging middleware
function logger(req, res, next) {
console.log(`\({req.method} \){req.url}`);
next(); // Pass to next middleware
}
app.use(logger);
app.get('/', (req, res) => {
res.send('Home page');
});
app.listen(3000);
Every request is logged, then passed to the route handler.
Output for GET /:
GET /
Middleware Execution Order
Middleware runs in the order you define it:
import express from 'express';
const app = express();
app.use((req, res, next) => {
console.log('1: First middleware');
next();
});
app.use((req, res, next) => {
console.log('2: Second middleware');
next();
});
app.get('/', (req, res) => {
console.log('3: Route handler');
res.send('Done');
});
app.listen(3000);
For a GET / request, output is:
1: First middleware
2: Second middleware
3: Route handler
Order matters. Middleware defined first runs first.
The next() Function
Calling next() passes control to the next function in the chain. Not calling it stops execution:
app.use((req, res, next) => {
console.log('Middleware 1');
next(); // Continue
});
app.use((req, res, next) => {
console.log('Middleware 2');
// Not calling next() - stops here
});
app.get('/', (req, res) => {
console.log('Route'); // Never reached
res.send('Hi');
});
This stops at "Middleware 2". The route handler is never called.
Types of Middleware
Application-Level Middleware
Runs for all routes or specific routes:
import express from 'express';
const app = express();
// Runs for ALL routes
app.use((req, res, next) => {
console.log('Global middleware');
next();
});
// Runs only for /admin routes
app.use('/admin', (req, res, next) => {
console.log('Admin middleware');
next();
});
app.get('/', (req, res) => res.send('Home'));
app.get('/admin/users', (req, res) => res.send('Admin page'));
app.listen(3000);
Router-Level Middleware
Middleware on a specific router:
import express from 'express';
const app = express();
const router = express.Router();
router.use((req, res, next) => {
console.log('Router middleware');
next();
});
router.get('/users', (req, res) => res.send('Users'));
app.use('/api', router);
app.listen(3000);
Built-In Middleware
Express provides standard middleware:
app.use(express.json());
app.use(express.static('public'));
app.use(express.urlencoded({ extended: true }));
Third-Party Middleware
Use packages from npm:
npm install cors
import cors from 'cors';
app.use(cors()); // Enable CORS
Real-World Middleware Examples
Authentication Middleware
function authenticateToken(req, res, next) {
const token = req.headers.authorization?.split(' ')[1];
if (!token) {
return res.status(401).send('No token');
}
// Verify token (simplified)
if (token === 'valid-token') {
req.user = { id: 1 };
next();
} else {
res.status(403).send('Invalid token');
}
}
app.get('/protected', authenticateToken, (req, res) => {
res.send(`Hello user ${req.user.id}`);
});
Error Handling Middleware
app.get('/data', (req, res, next) => {
try {
throw new Error('Something went wrong');
} catch (error) {
next(error); // Pass to error handler
}
});
// Error handling middleware (must have 4 parameters)
app.use((err, req, res, next) => {
console.error(err.message);
res.status(500).send('Server error');
});
Request Timing Middleware
app.use((req, res, next) => {
const start = Date.now();
res.on('finish', () => {
const duration = Date.now() - start;
console.log(`\({req.method} \){req.url} - ${duration}ms`);
});
next();
});
Middleware with Parameters
Middleware factories return middleware functions:
function logMessages(format) {
return (req, res, next) => {
if (format === 'simple') {
console.log(`\({req.method} \){req.url}`);
} else if (format === 'detailed') {
console.log(`\({req.method} \){req.url} - ${req.headers['user-agent']}`);
}
next();
};
}
app.use(logMessages('simple'));
// or
app.use(logMessages('detailed'));
Complete Example with Multiple Middleware
import express from 'express';
const app = express();
// Built-in middleware
app.use(express.json());
// Custom logging middleware
app.use((req, res, next) => {
console.log(`[\({new Date().toISOString()}] \){req.method} ${req.url}`);
next();
});
// Authentication middleware
function authenticate(req, res, next) {
const token = req.query.token;
if (token === 'secret') {
req.user = { id: 1, name: 'John' };
next();
} else {
res.status(401).send('Unauthorized');
}
}
// Request validation middleware
function validateRequest(req, res, next) {
if (!req.body.email) {
return res.status(400).send('Email required');
}
next();
}
// Public route
app.get('/home', (req, res) => {
res.send('Welcome');
});
// Protected route
app.get('/profile', authenticate, (req, res) => {
res.send(`Hello ${req.user.name}`);
});
// Route with validation
app.post('/register', validateRequest, (req, res) => {
res.send(`Registered ${req.body.email}`);
});
// Error handling middleware (must be last)
app.use((err, req, res, next) => {
console.error(err);
res.status(500).json({ error: 'Server error' });
});
app.listen(3000, () => {
console.log('Server running');
});
Common Mistakes
Mistake 1: Forgetting to call next()
// Wrong - middleware stops here
app.use((req, res, next) => {
console.log('Middleware');
// No next() call - route never executes
});
app.get('/', (req, res) => {
res.send('Hello'); // Never reached
});
// Right
app.use((req, res, next) => {
console.log('Middleware');
next(); // Passes to next handler
});
Mistake 2: Wrong middleware order
// Wrong - middleware after route can't help
app.get('/', (req, res) => {
res.send(req.body); // undefined - JSON not parsed yet
});
app.use(express.json()); // Too late!
// Right - middleware before routes
app.use(express.json());
app.get('/', (req, res) => {
res.send(req.body); // Properly parsed
});
Mistake 3: Error handler must have 4 parameters
// Wrong - Express won't recognize as error handler
app.use((err, req, res) => {
res.send('Error');
});
// Right - all 4 parameters required
app.use((err, req, res, next) => {
res.send('Error');
});
Key Takeaways
Middleware intercepts requests and can modify them or stop them
Middleware runs in the order it's defined
Call next() to pass to the next middleware
Express provides built-in middleware like express.json()
You can create custom middleware for any task
Application-level middleware runs for all/specific routes
Error handlers are middleware with 4 parameters
Order matters: define middleware before routes that need it
Middleware is the backbone of Express applications. Master it, and you can build clean, modular, and powerful web applications.
