Express Middleware: The Chain of Command for Requests

Why it exists

Express is a minimal framework by design. It needed a structured, composable way to handle tasks common to many requests—like logging, authentication, or data parsing—without cluttering the final route handler. Middleware provides this ordered pipeline for processing requests.

The mental model

An Express application is a pipeline of functions, not just a collection of endpoints. A request enters one end and flows through each middleware in sequence. Each function is a gatekeeper with three choices: first, modify the request or response and pass it on by calling next(); second, end the request by sending a response (e.g., res.json()); or third, pass control to an error handler.

How it works

A middleware function is a function with access to the request object (req), the response object (res), and the next function. It can execute any code. For example, an authentication middleware might verify a token and attach the user's data to the request object, like req.user = userData. To continue the processing chain, it MUST call next(). To stop the chain and reply to the client, it calls a response method like res.send(). If a middleware does neither, the request hangs. Middleware is loaded using app.use() for all requests or app.METHOD() for specific HTTP verbs and paths.

When to use it

Use middleware for any logic that needs to run before your main route handler, especially for shared, cross-cutting concerns. Common uses include: first, logging request details; second, parsing incoming data with express.json() or express.urlencoded(); third, authenticating and authorizing users; and fourth, serving static files from a directory.

When not to use it

Avoid putting unique business logic for a single endpoint inside a generic, globally-applied middleware. If logic only applies to POST /products and nowhere else, it belongs in that specific route handler. Middleware is for reusable concerns, not one-off endpoint logic.

One canonical example

A simple request logger is the classic "hello world" of middleware. Placed at the top of your application, it runs for every incoming request.

app.use((req, res, next) => {
console.log('Time:', Date.now(), 'Path:', req.path);
next();
});

This function logs the timestamp and path, then crucially calls next() to pass control to the next function in the chain, allowing the request to be processed further.