Express Middleware: Intercepting Requests Before Your Route Handler

Why it exists

Express needs a way to handle cross-cutting concerns—tasks that apply to many different routes, like logging, authentication, or data parsing. Instead of duplicating this logic in every route handler, middleware provides a single, reusable place to put it. This keeps route handlers clean and focused on their specific business logic.

The mental model

An Express middleware function is like a checkpoint in an assembly line for an incoming HTTP request. The request arrives and is passed to the first checkpoint. The worker there can inspect it, modify it, reject it, or simply pass it to the next station by calling next(). This continues until a checkpoint decides to ship the final product (send a response) or it reaches the end of the line (the final route handler).

How it works

A middleware function is a JavaScript function with the signature (req, res, next). It receives the request object (req), the response object (res), and a callback function (next). Inside the function, you can execute any code, modify req or res, or end the request cycle. To pass control to the next middleware in the stack, you must call next(). If you don't call next() and you also don't send a response with a method like res.send(), the request will hang and eventually time out. Starting with Express 5, if a middleware function returns a promise and it rejects, Express automatically calls next() with the error.

When to use it

Use middleware for any logic that needs to run on multiple routes. Common use cases include: first, logging request details like the method and path; second, authenticating users by checking for tokens or sessions; third, parsing request bodies (like express.json()); fourth, adding custom properties to the req object for downstream handlers to use.

When not to use it

Avoid putting core business logic for a single endpoint into a middleware function that runs on many routes. Middleware is for shared concerns. If logic is specific to /users/:id, it belongs in that route handler, not in a global middleware. Overusing middleware can also make it hard to trace the flow of a request.

One canonical example

A simple logger is a classic example. This function logs the timestamp of every incoming request, then passes control to the next function in the chain.

const requestTime = (req, res, next) => {
req.requestTime = Date.now();
console.log('Request received at:', req.requestTime);
next();
};

app.use(requestTime);

app.get('/', (req, res) => {
res.send(Hello! Request was received at ${req.requestTime});
});

When a request is made, the console will log the timestamp, and the response will include it.