Express.js.

Create an application by calling express(), register a route on it, and start the server with app.listen(). Install the package first with npm install express.

const express = require('express');
const app = express();
const PORT = 3000;
app.get('/', (req, res) => {
  res.send('Hello World!');
});
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});

app.get('/', ...) registers a route handler that runs for GET requests to the root path, and res.send() writes the response. The server listens on port 3000 and answers the root route with Hello World!. Express answers every other path with 404 Not Found. app.listen() returns the Node.js http.Server it creates, which you keep when you need to close the server later.

Middleware is a function that runs during the request-response cycle. It has access to the request object req, the response object res, and the next function. Express passes each request through a chain of these functions, in the order you register them.

A middleware function can:

• run any code, such as logging or timing
• change req or res, for example by adding req.user
• end the cycle by sending a response
• call next() to hand control to the next function in the chain

// Custom middleware
app.use((req, res, next) => {
  console.log('Time:', Date.now());
  next(); // Call next to continue to the next middleware
});

This one logs a timestamp for every request and then calls next(), so the routes still run. A middleware that neither responds nor calls next() leaves the request hanging.

The Express docs list five types of middleware.

1. Application-level middleware is bound to the app object with app.use().
2. Router-level middleware works the same way, but is bound to an express.Router() instance with router.use().
3. Error-handling middleware takes four arguments, (err, req, res, next).
4. Built-in middleware ships with Express, such as express.static and express.json.
5. Third-party middleware comes from npm packages, such as morgan, cors and helmet.

The types overlap. Third-party cors() mounted with router.use() is also router-level middleware, and an error handler can sit on the app or on a router.

Express has one routing method per HTTP method, named after it in lowercase, such as app.get(), app.post() and app.delete(). Each takes a path and a handler, and the handler runs only when both the method and the path match.

app.get('/users', (req, res) => {
  res.send('GET request');
});
app.post('/users', (req, res) => {
  res.send('POST request');
});
app.put('/users/:id', (req, res) => {
  res.send('PUT request');
});
app.delete('/users/:id', (req, res) => {
  res.send('DELETE request');
});

Here /users answers GET and POST with different handlers, and /users/:id answers PUT and DELETE for one user. A method that no route handles, such as PATCH on /users, falls through to the 404 response. app.get() also answers HEAD requests for the same path.

To keep every method of one path together, chain them with app.route(), such as app.route('/users').get(...).post(...). Use app.all() when one handler must run for every method.

next() passes control to the next middleware or route handler in the chain. A middleware that does not send a response must call it, or the request is left hanging.

app.use((req, res, next) => {
  if (req.headers.authorization) {
    next(); // Continue to next middleware
  } else {
    next(new Error('Unauthorized')); // Trigger error handling
  }
});

next has three common forms:

• next() moves on to the next matching function.
• next(err) skips the normal functions and jumps to the error-handling middleware.
• next('route') skips the remaining callbacks of the current route and moves to the next matching route.

Use return next() when more code follows, so the function stops there.

Use the built-in express.static middleware and point it at a folder. Express then maps request paths to files in that folder, such as images, CSS and JavaScript.

// Serve files from 'public' directory
app.use(express.static('public'));
// Serve with virtual path prefix
app.use('/static', express.static('public'));

With the first line, public/logo.png is served at /logo.png, because the folder name is not part of the URL. The second line adds a virtual path prefix, so the same file is also at /static/logo.png. The folder path is relative to where you start the node process, so path.join(__dirname, 'public') is safer.

When no file matches, the middleware calls next(), so later routes still run. In Express 5, it ignores dotfiles such as .env by default. For high traffic, put a reverse proxy cache in front of the static files.

Express.js is a minimal web framework for Node.js. It adds routing, middleware and response helpers on top of Node's built-in http module.

With plain http, one callback parses the URL, reads the body stream and sets headers such as Content-Type itself. Express gives you routes such as app.get('/users/:id', handler), a middleware chain for shared steps such as authentication, and helpers such as res.json().

Teams use it for REST APIs and server-rendered sites. Its small core is quick to learn, and middleware packages add most other features. It is unopinionated, so it does not pick a folder structure, a validation library or a database for you. Express 5 is the current major version and needs Node.js 18 or later.