Introduction to Express.js

History & Philosophy

Express was created by TJ Holowaychuk in 2010, inspired by Ruby's Sinatra. It is the de facto standard web framework for Node.js — minimalist by design, providing a thin layer of features without obscuring Node's own APIs.

Creating the App

const express = require('express');
const app = express();

// app is both a function and an object
// — it holds settings, routes, and
//   acts as the request handler

HTTP Methods

app.get('/users',    handler); // Read
app.post('/users',   handler); // Create
app.put('/users/1',  handler); // Replace
app.patch('/users/1',handler); // Update
app.delete('/users/1',handler);// Delete

// Match ALL methods
app.all('/secret', requireAuth, handler);

express.Router()

// routes/users.js
const router = require('express').Router();

router.get('/', (req, res) => {
  res.json(users);
});

router.get('/:id', (req, res) => {
  res.json(users[req.params.id]);
});

router.post('/', (req, res) => {
  // create user
});

module.exports = router;

req — Key Properties

The Middleware Signature

// Every middleware is a function with
// (req, res, next)
const logger = (req, res, next) => {
  console.log(`${req.method} ${req.path}`);
  next(); // pass to next middleware
};

app.use(logger);

If you don't call next(), the request hangs — no response is ever sent.

express.json()

// Parses JSON request bodies
app.use(express.json());

// Options
app.use(express.json({
  limit: '10kb',      // max body size
  strict: true,       // only objects/arrays
  type: 'application/json'
}));

// POST { "name": "Ada" }
app.post('/api/users', (req, res) => {
  console.log(req.body.name); // 'Ada'
});

Essential Packages

Custom Error Classes

class AppError extends Error {
  constructor(message, status = 500) {
    super(message);
    this.status = status;
    this.isOperational = true;
  }
}

class NotFoundError extends AppError {
  constructor(resource = 'Resource') {
    super(`${resource} not found`, 404);
  }
}

// Usage in route
app.get('/users/:id', async (req, res, next) => {
  const user = await User.findById(req.params.id);
  if (!user) return next(new NotFoundError('User'));
  res.json(user);
});

Setting Up a View Engine

const path = require('path');

// Tell Express which engine to use
app.set('view engine', 'ejs');

// Tell Express where views live
app.set('views', path.join(
  __dirname, 'views'
));

// Now .ejs extension is optional:
res.render('home'); // views/home.ejs

express.static() Basics

const path = require('path');

// Serve from /public directory
app.use(express.static(
  path.join(__dirname, 'public')
));

// File structure:
// public/
//   css/style.css    → /css/style.css
//   js/app.js        → /js/app.js
//   images/logo.png  → /images/logo.png
//   index.html       → / (auto-served)

NODE_ENV

// Express checks NODE_ENV internally
// 'production' enables:
//   - view caching
//   - less verbose errors
//   - better performance

// Check in code
if (app.get('env') === 'production') {
  app.set('trust proxy', 1);
  app.use(helmet());
}

// Set via CLI
// NODE_ENV=production node app.js

CORS Configuration

const cors = require('cors');

// Allow specific origin
app.use(cors({
  origin: 'https://myapp.com',
  methods: ['GET', 'POST'],
  credentials: true
}));

// Dynamic origin
app.use(cors({
  origin: (origin, cb) => {
    const allowed = ['https://a.com', 'https://b.com'];
    cb(null, allowed.includes(origin));
  }
}));

MVC Directory Layout

my-express-app/
├── app.js              ← Express setup
├── server.js           ← listen() entry
├── package.json
├── .env
├── config/
│   ├── db.js
│   └── index.js        ← merged config
├── routes/
│   ├── index.js        ← mounts all routers
│   ├── auth.js
│   ├── users.js
│   └── posts.js
├── controllers/
│   ├── authController.js
│   ├── userController.js
│   └── postController.js
├── services/
│   ├── userService.js
│   └── emailService.js
├── models/
│   ├── User.js
│   └── Post.js
├── middleware/
│   ├── auth.js
│   ├── validate.js
│   └── errorHandler.js
├── views/
│   ├── layouts/
│   ├── partials/
│   └── pages/
├── public/
│   ├── css/
│   ├── js/
│   └── images/
└── tests/
    ├── routes/
    └── services/

Automatic Promise Rejection Handling

// Express 4 — must wrap or use library
app.get('/data', async (req, res, next) => {
  try {
    const data = await fetchData();
    res.json(data);
  } catch (err) {
    next(err); // manual forwarding
  }
});

// Express 5 — just throw!
app.get('/data', async (req, res) => {
  const data = await fetchData();
  res.json(data);
  // Rejected promise → error middleware
  // automatically — no wrapper needed
});

app.js — REST API + Views

const express = require('express');
const path = require('path');
const helmet = require('helmet');
const morgan = require('morgan');
const app = express();

// Config
app.set('view engine', 'ejs');
app.set('views', path.join(__dirname, 'views'));

// Middleware
app.use(helmet());
app.use(morgan('dev'));
app.use(express.json());
app.use(express.urlencoded({ extended: true }));
app.use(express.static('public'));

app.locals.siteName = 'TaskBoard';
app.locals.year = new Date().getFullYear();

let tasks = [
  { id: 1, title: 'Learn Express',
    done: false },
  { id: 2, title: 'Build an API',
    done: true },
];
let nextId = 3;

// Views
app.get('/', (req, res) => {
  res.render('home', { title: 'Tasks', tasks });
});

// REST API
app.get('/api/tasks', (req, res) => {
  res.json(tasks);
});

app.post('/api/tasks', (req, res) => {
  const { title } = req.body;
  if (!title) return res.status(400)
    .json({ error: 'Title required' });
  const task = { id: nextId++, title, done: false };
  tasks.push(task);
  res.status(201).json(task);
});

app.patch('/api/tasks/:id', (req, res) => {
  const task = tasks.find(
    t => t.id === +req.params.id
  );
  if (!task) return res.status(404)
    .json({ error: 'Not found' });
  Object.assign(task, req.body);
  res.json(task);
});

app.delete('/api/tasks/:id', (req, res) => {
  tasks = tasks.filter(
    t => t.id !== +req.params.id
  );
  res.sendStatus(204);
});