Handling GET and POST Requests in Express

GET and POST requests are the two HTTP methods you will use most frequently in a MERN REST API. GET requests read data — they fetch posts, users, or any resource from MongoDB and return it as JSON. POST requests write data — they receive a JSON body from React, validate it, save it to MongoDB, and return the newly created resource. Understanding how to define both route types, how to read everything from the incoming request, and how to send correct responses is the core skill of Express API development.

HTTP Methods — A REST Refresher #

Defining GET Routes #

// In-memory store for this lesson — replaced with MongoDB in Chapter 9+
let posts = [
  { id: 1, title: 'Getting Started with MERN', body: 'MERN is a powerful stack...', published: true },
  { id: 2, title: 'Node.js Basics',             body: 'Node.js runs on V8...',      published: true },
  { id: 3, title: 'Draft Post',                 body: 'Work in progress...',         published: false },
];

// ── GET all posts ─────────────────────────────────────────────────────────────
app.get('/api/posts', (req, res) => {
  // Query string filtering: GET /api/posts?published=true
  const { published } = req.query;

  let result = posts;
  if (published !== undefined) {
    result = posts.filter(p => p.published === (published === 'true'));
  }

  res.json({ success: true, count: result.length, data: result });
});

// ── GET single post by ID ─────────────────────────────────────────────────────
app.get('/api/posts/:id', (req, res) => {
  const id   = parseInt(req.params.id);   // params are always strings — parse if needed
  const post = posts.find(p => p.id === id);

  if (!post) {
    return res.status(404).json({ success: false, message: `Post with id ${id} not found` });
  }

  res.json({ success: true, data: post });
});

// ── GET all published posts by a specific tag ─────────────────────────────────
app.get('/api/posts/tag/:tag', (req, res) => {
  const { tag }  = req.params;
  const filtered = posts.filter(p => p.tags && p.tags.includes(tag));
  res.json({ success: true, count: filtered.length, data: filtered });
});

Defining POST Routes #

// ── POST — create a new post ───────────────────────────────────────────────────
app.post('/api/posts', (req, res) => {
  // Destructure only the fields we expect — do NOT spread all of req.body
  const { title, body, tags } = req.body;

  // Basic validation
  if (!title || !body) {
    return res.status(400).json({
      success: false,
      message: 'Title and body are required',
    });
  }

  if (typeof title !== 'string' || title.trim().length < 3) {
    return res.status(400).json({
      success: false,
      message: 'Title must be a string with at least 3 characters',
    });
  }

  // Create the post
  const newPost = {
    id:        posts.length + 1,
    title:     title.trim(),
    body:      body.trim(),
    tags:      Array.isArray(tags) ? tags : [],
    published: false,
    createdAt: new Date().toISOString(),
  };

  posts.push(newPost);

  // 201 Created — not 200 — for successful resource creation
  res.status(201).json({ success: true, data: newPost });
});

Reading From the Request Object #

app.get('/api/posts/:id/comments', (req, res) => {
  // ── URL parameters (:id, :slug, etc.) ─────────────────────────────────────
  const postId = req.params.id;          // '/api/posts/42/comments' → '42'

  // ── Query string (?key=value) ─────────────────────────────────────────────
  const page    = parseInt(req.query.page)  || 1;
  const limit   = parseInt(req.query.limit) || 10;
  const sort    = req.query.sort || 'createdAt';
  // GET /api/posts/42/comments?page=2&limit=5&sort=likes

  // ── Request headers ───────────────────────────────────────────────────────
  const authHeader    = req.headers['authorization']; // 'Bearer eyJ...'
  const contentType   = req.headers['content-type'];  // 'application/json'
  const userAgent     = req.headers['user-agent'];

  res.json({ postId, page, limit, sort });
});

app.post('/api/posts', (req, res) => {
  // ── Request body (requires express.json() middleware) ─────────────────────
  const { title, body, tags, published } = req.body;
  // Only available if:
  // 1. express.json() middleware is active
  // 2. Client sent Content-Type: application/json header
  // 3. Request has a body (GET requests do not)

  res.status(201).json({ received: { title, body } });
});

Testing GET and POST with Postman #

── Test GET all posts ────────────────────────────────────────────────────────
Method: GET
URL:    http://localhost:5000/api/posts
→ Expected: 200  { success: true, count: 3, data: [...] }

── Test GET with query filter ────────────────────────────────────────────────
Method: GET
URL:    http://localhost:5000/api/posts?published=true
→ Expected: 200  { success: true, count: 2, data: [...] }

── Test GET single post ──────────────────────────────────────────────────────
Method: GET
URL:    http://localhost:5000/api/posts/1
→ Expected: 200  { success: true, data: { id: 1, title: '...' } }

── Test GET missing post ────────────────────────────────────────────────────
Method: GET
URL:    http://localhost:5000/api/posts/999
→ Expected: 404  { success: false, message: 'Post with id 999 not found' }

── Test POST create post ─────────────────────────────────────────────────────
Method: POST
URL:    http://localhost:5000/api/posts
Headers: Content-Type: application/json
Body (raw JSON):
  { "title": "My New Post", "body": "Post content here", "tags": ["mern"] }
→ Expected: 201  { success: true, data: { id: 4, title: 'My New Post', ... } }

── Test POST missing fields ──────────────────────────────────────────────────
Method: POST
URL:    http://localhost:5000/api/posts
Body:   { "title": "No body field" }
→ Expected: 400  { success: false, message: 'Title and body are required' }

Common Mistakes #

Mistake 1 — Using req.body on a GET request #

❌ Wrong — trying to send data in the body of a GET request:

// React code
axios.get('/api/posts', { body: JSON.stringify({ filter: 'published' }) });
// req.body will be undefined — GET requests do not have a body

✅ Correct — use query strings for GET request parameters:

axios.get('/api/posts', { params: { published: true } });
// Server: req.query.published === 'true' ✓

Mistake 2 — Spreading req.body directly into a document #

❌ Wrong — allowing any field from the request to be saved:

const newPost = { id: posts.length + 1, ...req.body };
// A malicious user sends: { "title": "x", "isAdmin": true, "__proto__": {} }
// All of those fields end up in your data store

✅ Correct — destructure only expected fields:

const { title, body, tags } = req.body;
const newPost = { id: posts.length + 1, title, body, tags }; // only known fields ✓

Mistake 3 — Not parsing URL params to the correct type #

❌ Wrong — comparing a string param directly to a number ID:

const post = posts.find(p => p.id === req.params.id);
// req.params.id is '1' (string) — posts have numeric ids
// '1' === 1 is false → post is always undefined

✅ Correct — convert params to the expected type before using:

const id   = parseInt(req.params.id, 10);
const post = posts.find(p => p.id === id); // number === number ✓

Quick Reference #