Middleware

The pipeline every request flows through - what middleware functions are, built-in middleware, third-party middleware, and writing your own.

What it is, in plain English: Middleware is a function with access to the request, response, and a 'next' function, that runs in the middle of the request-response cycle -- before your route handler. Middleware can run code, modify req/res, end the request, or call next() to pass control to the next middleware in the chain. This is THE core architectural pattern in Express -- logging, authentication, parsing request bodies, and error handling are all implemented as middleware.

The pipeline every request passes through

Middleware is the single most important concept in Express. Every piece of request processing -- parsing JSON bodies, checking authentication, logging, serving static files, handling errors -- is implemented as middleware.

The middleware function signature

function myMiddleware(req, res, next) {
  // req  -- the incoming request
  // res  -- the outgoing response
  // next -- call this to pass control to the NEXT middleware in the chain

  console.log("This runs for every request that reaches this middleware");
  next();   // without calling next(), the request hangs forever!
}

app.use(myMiddleware);   // applies to ALL routes

Three things a middleware function can do

// 1. Run code and pass control onward:
app.use((req, res, next) => {
  console.log(`${req.method} ${req.url}`);
  next();   // continue to the next middleware/route handler
});

// 2. End the request-response cycle:
app.use((req, res, next) => {
  if (isMaintenanceMode) {
    return res.status(503).send("Down for maintenance");   // no next() -- chain stops here
  }
  next();
});

// 3. Modify req or res before passing it on:
app.use((req, res, next) => {
  req.requestTime = Date.now();   // add a custom property
  next();
});
app.get("/", (req, res) => {
  res.send(`Request received at ${req.requestTime}`);   // can use it later
});

Built-in middleware

// Parse JSON request bodies (without this, req.body is undefined for JSON requests):
app.use(express.json());

// Parse URL-encoded form bodies:
app.use(express.urlencoded({ extended: true }));

// Serve static files (CSS, images, client-side JS) from a folder:
app.use(express.static("public"));
// A request to /style.css automatically serves public/style.css

Order matters

// Middleware runs in the EXACT order you register it:
app.use(express.json());        // 1. parse JSON first
app.use(logRequest);            // 2. then log (can now log req.body too)
app.use("/api", apiRouter);     // 3. then route to handlers

// If you registered logRequest BEFORE express.json(), req.body
// would still be undefined when the logger tried to use it.

Try It Yourself (Node.js logic)

// Middleware -- the (req, res, next) pipeline pattern

// The shape every middleware function has:
function exampleMiddleware(req, res, next) {
  console.log(`${req.method} ${req.url}`);   // do something
  next();                                     // pass control onward
}

// Simulating Express's middleware chain with plain functions:
function createApp() {
  const middlewares = [];

return {
    use(fn) { middlewares.push(fn); },
    handle(req, res) {
      let index = 0;
      function next() {
        const middleware = middlewares[index++];
        if (middleware) middleware(req, res, next);
        else console.log("[Final] Request handled:", req.url);
      }
      next();
    }
  };
}

const app = createApp();

// Logging middleware -- runs first
app.use((req, res, next) => {
  console.log(`-> ${req.method} ${req.url}`);
  next();
});

// Auth check middleware -- runs second
app.use((req, res, next) => {
  if (!req.headers.authorization) {
    console.log("-> Unauthorized! Stopping here (not calling next)");
    return;  // doesn't call next() -- chain stops here
  }
  console.log("-> Authorized, continuing");
  next();
});

// Final handler -- runs third (only if authorized)
app.use((req, res) => {
  console.log("-> Sending response");
});

console.log("Request 1 (no auth header):");
app.handle({ method: "GET", url: "/protected", headers: {} }, {});

console.log("\nRequest 2 (with auth header):");
app.handle({ method: "GET", url: "/protected", headers: { authorization: "Bearer xyz" } }, {});

Third-party middleware and writing reusable middleware

Popular third-party middleware

// npm install cors morgan helmet cookie-parser

import cors from "cors";
import morgan from "morgan";
import helmet from "helmet";
import cookieParser from "cookie-parser";

app.use(helmet());                          // sets secure HTTP headers
app.use(cors({ origin: "https://myapp.com" })); // allow cross-origin requests
app.use(morgan("dev"));                      // log every request (method, path, status, time)
app.use(cookieParser());                     // parse cookies into req.cookies

// Each of these is JUST a function matching (req, res, next) --
// there's no special "middleware API", it's the same contract you write yourself.

Writing configurable middleware (a function that returns middleware)

// A middleware FACTORY -- takes config, returns the actual middleware function:
function requireRole(role) {
  return function(req, res, next) {
    if (req.user?.role !== role) {
      return res.status(403).json({ error: `Requires ${role} role` });
    }
    next();
  };
}

app.get("/admin/users", requireRole("admin"), (req, res) => {
  res.json(getAllUsers());
});
app.get("/moderator/reports", requireRole("moderator"), (req, res) => {
  res.json(getReports());
});
// Each route gets its OWN configured instance of the middleware

Middleware scope -- global, router-level, route-level

// Global -- applies to every request:
app.use(express.json());

// Router-level -- applies only to routes in this router:
const router = express.Router();
router.use(requireAuth);

// Route-level -- applies only to one specific route, as extra arguments:
app.get("/admin", requireAuth, requireRole("admin"), (req, res) => {
  res.send("Admin panel");
});
// Multiple middleware functions can be chained before the final handler --
// each must call next() for the chain to reach the next one

Async middleware, error-handling middleware, and execution order proofs

// Async middleware -- errors in async functions need explicit handling
// (Express 4) or are caught automatically (Express 5):

// Express 4 -- manual wrapper needed, or errors are silently swallowed:
function asyncHandler(fn) {
  return (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next);
}
app.get("/users/:id", asyncHandler(async (req, res) => {
  const user = await db.users.findById(req.params.id);   // if this throws, asyncHandler catches it
  res.json(user);
}));

// Express 5 -- catches rejected promises in async handlers automatically:
app.get("/users/:id", async (req, res) => {
  const user = await db.users.findById(req.params.id);   // throws are caught natively
  res.json(user);
});

Error-handling middleware -- the 4-argument signature

// A middleware function with FOUR parameters (err, req, res, next) is
// specially recognised by Express as an error handler:
app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(err.status ?? 500).json({ error: err.message });
});
// Must be registered LAST, after all routes and other middleware.
// Triggered by: calling next(err) anywhere, or a thrown error in an
// async route handler (Express 5) or asyncHandler-wrapped one (Express 4).

The middleware stack as a literal linked traversal

Internally, Express stores registered middleware/routes as an ordered array of "Layer" objects on the app's router. Each incoming request triggers a dispatch function that iterates this array, testing each layer's path/method match, and invoking matching layers' handler with a bound next callback that simply advances the iteration index and recurses. This is precisely why middleware order is execution order — there is no separate scheduling or prioritization layer, just sequential array traversal with early termination whenever a handler sends a response without calling next().

Official Sources

The Codex links only to official documentation. No third-party tutorials.