Request & Response

The req and res objects every handler receives - reading data from requests, sending different response types, status codes, and headers.

What it is, in plain English: Every Express route handler and middleware function receives a request object (req) and a response object (res). req holds everything about the incoming request -- URL parameters, query string, headers, body, cookies. res provides methods to send a reply -- text, JSON, files, redirects, with control over status code and headers. These two objects are Express's enhanced wrappers around Node's raw IncomingMessage and ServerResponse.

Reading requests and sending responses

The request object -- everything about the incoming request

app.post("/users/:id", (req, res) => {
  console.log(req.params);   // URL parameters: { id: "42" }
  console.log(req.query);    // query string: ?key=value pairs
  console.log(req.body);     // parsed request body (needs express.json() middleware)
  console.log(req.headers);  // all request headers
  console.log(req.method);   // "POST"
  console.log(req.url);      // the full URL path + query string
});

Sending different types of responses

// Plain text or HTML:
app.get("/", (req, res) => {
  res.send("Hello, World!");
});

// JSON (the most common for APIs):
app.get("/api/user", (req, res) => {
  res.json({ name: "Alice", age: 30 });
});

// With a specific status code:
app.post("/users", (req, res) => {
  res.status(201).json({ created: true });   // 201 = Created
});

app.get("/users/:id", (req, res) => {
  const user = findUser(req.params.id);
  if (!user) {
    return res.status(404).json({ error: "User not found" });
  }
  res.json(user);
});

Status codes -- the standard set

Code

Meaning

When

200

Successful GET/PUT

201

Created

Successful POST that created something

204

No Content

Successful DELETE

400

Bad Request

Client sent invalid data

401

Unauthorized

Missing/invalid authentication

403

Forbidden

Authenticated but not allowed

404

Not Found

Resource doesn't exist

500

Server Error

Something broke on your end

Redirects

app.get("/old-page", (req, res) => {
  res.redirect("/new-page");          // 302 by default
  // res.redirect(301, "/new-page");  // permanent redirect
});

Try It Yourself (Node.js logic)

// req and res -- the two objects every handler receives

const REQUEST_RESPONSE_EXAMPLES = `
app.post("/users/:id/comments", (req, res) => {
  // READING from the request:
  console.log(req.params.id);       // URL parameter: /users/:id
  console.log(req.query.sort);      // query string: ?sort=newest
  console.log(req.body);            // parsed JSON/form body (needs express.json() first)
  console.log(req.headers["authorization"]);  // request headers
  console.log(req.cookies);         // needs cookie-parser middleware
  console.log(req.method);          // "POST"
  console.log(req.path);            // "/users/42/comments"
  console.log(req.ip);              // client IP address

// SENDING a response:
  res.status(201).json({ created: true, id: 99 });
});
`;

console.log(REQUEST_RESPONSE_EXAMPLES.trim());

// Demonstrating response method variety conceptually:
const responseMethods = {
  "res.send(str)":       "Send text/HTML -- Content-Type auto-detected",
  "res.json(obj)":       "Send JSON -- sets Content-Type: application/json",
  "res.status(code)":    "Set status code -- chainable: res.status(404).send(...)",
  "res.sendStatus(code)":"Set status AND send its standard text -- res.sendStatus(404)",
  "res.redirect(url)":   "302 redirect to another URL",
  "res.sendFile(path)":  "Send a file from disk",
  "res.download(path)":  "Send a file as an attachment (triggers browser download)",
  "res.set(header, val)":"Set a custom response header",
  "res.cookie(name, val)":"Set a cookie (needs cookie-parser for reading later)",
};

console.log("\nResponse method reference:");
Object.entries(responseMethods).forEach(([method, desc]) => {
  console.log(`  ${method.padEnd(24)} ${desc}`);
});

// Common status code reference:
const statusCodes = {
  200: "OK", 201: "Created", 204: "No Content",
  400: "Bad Request", 401: "Unauthorized", 403: "Forbidden", 404: "Not Found",
  409: "Conflict", 422: "Unprocessable Entity", 429: "Too Many Requests",
  500: "Internal Server Error", 503: "Service Unavailable",
};
console.log("\nCommon status codes:");
Object.entries(statusCodes).forEach(([code, text]) => console.log(`  ${code} ${text}`));

Headers, cookies, and content negotiation

Reading and setting headers

app.get("/api/data", (req, res) => {
  const token = req.headers["authorization"]?.replace("Bearer ", "");
  const acceptLang = req.headers["accept-language"];

  res.set("X-Custom-Header", "some-value");
  res.set({
    "Cache-Control": "no-store",
    "X-Request-Id":  generateRequestId(),
  });

  res.json({ data: "..." });
});

Cookies

import cookieParser from "cookie-parser";
app.use(cookieParser());

app.post("/login", (req, res) => {
  // ... authenticate ...
  res.cookie("sessionId", token, {
    httpOnly: true,    // JS cannot read this cookie (XSS protection)
    secure:   true,    // only sent over HTTPS
    sameSite: "strict",// CSRF protection
    maxAge:   3600000, // 1 hour in ms
  });
  res.json({ loggedIn: true });
});

app.get("/profile", (req, res) => {
  const sessionId = req.cookies.sessionId;   // requires cookie-parser
  // ... look up session ...
});

Sending files

import path from "path";

app.get("/report.pdf", (req, res) => {
  res.sendFile(path.join(__dirname, "files/report.pdf"));
});

app.get("/download", (req, res) => {
  res.download(path.join(__dirname, "files/report.pdf"), "my-report.pdf");
  // triggers a browser download with the given filename, rather than displaying inline
});

Content negotiation

// Respond differently based on what the client accepts:
app.get("/users/:id", (req, res) => {
  const user = getUser(req.params.id);

  res.format({
    "application/json": () => res.json(user),
    "text/html":         () => res.send(`<h1>${user.name}</h1>`),
    default:              () => res.status(406).send("Not Acceptable"),
  });
});

Streaming responses and the underlying Node.js objects

// req and res ARE Node's http.IncomingMessage / http.ServerResponse,
// extended with extra Express methods -- you can mix raw Node APIs with Express ones:

app.get("/stream", (req, res) => {
  res.writeHead(200, { "Content-Type": "text/plain" });   // raw Node method, still works

  let count = 0;
  const interval = setInterval(() => {
    res.write(`chunk ${count++}\n`);   // raw Node streaming write
    if (count >= 5) {
      clearInterval(interval);
      res.end();   // raw Node method to finish the response
    }
  }, 1000);
});

// Streaming a large file without loading it into memory:
import { createReadStream } from "fs";
app.get("/video", (req, res) => {
  const stream = createReadStream("large-video.mp4");
  stream.pipe(res);   // pipes directly to the response stream
});

Response lifecycle and headersSent

Once res.writeHead() or any send method has flushed headers to the client, res.headersSent becomes true, and attempting to set further headers or call another send method throws an error ("Cannot set headers after they are sent"). This is a common bug source in middleware chains where a handler calls res.send() and then mistakenly also calls next() — the next middleware then tries to send its own response on an already-finished exchange.

Official Sources

The Codex links only to official documentation. No third-party tutorials.