Application-level vs router-level middleware
scoping of middleware.
app.use() binds to the app and runs everywhere; router.use() binds to a Router and runs only for that router's routes.
claiming they are interchangeable or that scope does not matter.
What's really being asked
This probes your understanding of where middleware executes and how Express composes routers into the request pipeline.
The full answer
Application-level middleware is attached directly to the app instance via app.use() (optionally with a path) and runs for every matching request across the entire application. Router-level middleware is attached to an express.Router() instance via router.use() and only executes for requests that match routes defined on that router, once the router is mounted with app.use('/path', router). Both share the same (req, res, next) contract; the difference is purely scope. Router-level middleware lets you apply behavior to a logical group of routes without affecting the rest of the app.
The mistakes people make
Claiming the two are interchangeable. Believing router-level middleware runs globally. Forgetting that the mount path prefixes all router routes. Applying authentication at app level when only the admin section needs it, either over-protecting public routes or, conversely, under-scoping security.
What usually comes next
How does mount path interact with router paths? What is the execution order when both app-level and router-level middleware match? How do you share data set in app-level middleware with router routes (via req)?
A concrete example
A use case for router-level middleware is gating an admin area. const adminRouter = express.Router(); adminRouter.use(requireAdmin); adminRouter.get('/dashboard', handler); app.use('/admin', adminRouter); Here requireAdmin only runs for /admin routes, so public routes stay open while everything under /admin is protected. Doing this with app.use(requireAdmin) would force authentication on every endpoint, including the login page itself, creating a redirect loop.
Interview question
You want authentication to apply only to routes under /admin without touching public routes. Which approach scopes it correctly?
- a.app.use(requireAuth) at the top of the main app file
- b.Put requireAuth inside express.json()
- c.Add requireAuth to every route via res.use()
- d.router.use(requireAuth) on the admin Router, mounted at /adminCorrect
Why? this is the answer
Router-level middleware on a Router mounted at /admin runs only for that group. A global app.use would protect every route, and res has no use() method.
Just read this? Test yourself on what you have been reading.
Read the original → expressjs.com
- #nodejs
- #express
- #middleware
- #router
- #scope
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on nodejs — each one lists the topics its interview covers.
See open roles