Middleware & Request Pipeline

🌿 Node.js Lesson 10 Intermediate

Middleware functions are the backbone of Express.js. They run in sequence during a request-response cycle, allowing you to add logging, authentication, validation, and error handling in a clean, composable way.

1 How Middleware Works

Every middleware function receives (req, res, next). Calling next() passes control to the next middleware in the stack:

JavaScript — Middleware Pipeline

const express = require('express');
const app = express();

// 1. Global middleware (runs on every request)
app.use((req, res, next) => {
  console.log(new Date().toISOString(), req.method, req.url);
  next(); // must call next() or the request will hang!
});

// 2. Built-in middleware
app.use(express.json());           // parses JSON bodies
app.use(express.urlencoded({ extended: true })); // parses form data
app.use(express.static('public')); // serves static files

// 3. Route-specific middleware
function requireAuth(req, res, next) {
  const token = req.headers.authorization;
  if (!token) return res.status(401).json({ error: 'No token provided' });
  req.user = { id: 1, name: 'Balaji' }; // attach data to req
  next();
}

app.get('/dashboard', requireAuth, (req, res) => {
  res.json({ welcome: req.user.name });
});

// 4. Error-handling middleware (4 parameters!)
app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(500).json({ error: err.message });
});

app.listen(3000);

2 Popular Third-Party Middleware

JavaScript — Common middleware packages

npm install cors helmet morgan compression

const cors        = require('cors');
const helmet      = require('helmet');    // security headers
const morgan      = require('morgan');    // request logging
const compression = require('compression'); // gzip responses

app.use(helmet());               // Sets 15+ security HTTP headers
app.use(cors({ origin: 'https://mysite.com' }));
app.use(morgan('combined'));     // Apache-style access logs
app.use(compression());         // Compress all responses

3 Code Challenge

Challenge: Write a custom rate-limiting middleware that blocks a client IP after more than 10 requests within a 60-second window, returning a 429 Too Many Requests response.