Express Router and Modular Route Files

When your Express API has five or ten routes, keeping them all in index.js is manageable. When it has fifty — covering posts, users, auth, comments, and file uploads — a single file becomes a maintenance nightmare. express.Router() is the solution: it lets you create mini Express applications that handle a subset of your routes, which you then mount on a path prefix in your main app. The result is a clean, modular project where each resource has its own dedicated route file, its own controller, and its own logical boundary. In this lesson you will refactor a single-file server into a properly structured Express application.

What express.Router() Provides #

Before — Everything in index.js #

// server/index.js — hard to maintain at scale
require('dotenv').config();
const express = require('express');
const app     = express();

app.use(express.json());

// Posts routes (mixed in with everything else)
app.get('/api/posts',    async (req, res) => { /* ... */ });
app.post('/api/posts',   async (req, res) => { /* ... */ });
app.get('/api/posts/:id', async (req, res) => { /* ... */ });
app.put('/api/posts/:id', async (req, res) => { /* ... */ });
app.delete('/api/posts/:id', async (req, res) => { /* ... */ });

// Auth routes
app.post('/api/auth/register', async (req, res) => { /* ... */ });
app.post('/api/auth/login',    async (req, res) => { /* ... */ });

// User routes
app.get('/api/users/:id',    async (req, res) => { /* ... */ });
app.patch('/api/users/:id',  async (req, res) => { /* ... */ });

app.listen(5000);

After — Modular Router Files #

// ── server/src/routes/posts.js ────────────────────────────────────────────────
const express    = require('express');
const router     = express.Router();
const {
  getAllPosts,
  getPostById,
  createPost,
  updatePost,
  deletePost,
} = require('../controllers/postController');
const protect = require('../middleware/auth');

// GET /api/posts  and  POST /api/posts
router.route('/')
  .get(getAllPosts)
  .post(protect, createPost);

// GET /api/posts/:id  PUT /api/posts/:id  DELETE /api/posts/:id
router.route('/:id')
  .get(getPostById)
  .put(protect, updatePost)
  .delete(protect, deletePost);

module.exports = router;

// ── server/src/routes/auth.js ─────────────────────────────────────────────────
const express = require('express');
const router  = express.Router();
const { register, login, getMe } = require('../controllers/authController');
const protect = require('../middleware/auth');

router.post('/register', register);
router.post('/login',    login);
router.get('/me',        protect, getMe);

module.exports = router;

// ── server/src/routes/users.js ────────────────────────────────────────────────
const express = require('express');
const router  = express.Router();
const { getUserProfile, updateProfile } = require('../controllers/userController');
const protect = require('../middleware/auth');

router.get('/:id',   getUserProfile);
router.patch('/:id', protect, updateProfile);

module.exports = router;

// ── server/index.js — clean and minimal ───────────────────────────────────────
require('dotenv').config();
const express   = require('express');
const cors      = require('cors');
const helmet    = require('helmet');
const connectDB = require('./src/config/db');

const app  = express();
const PORT = process.env.PORT || 5000;

connectDB();

// ── Global middleware ─────────────────────────────────────────────────────────
app.use(helmet());
app.use(cors({ origin: process.env.CLIENT_URL || 'http://localhost:5173' }));
app.use(express.json());

// ── Mount routers ─────────────────────────────────────────────────────────────
app.use('/api/posts', require('./src/routes/posts'));
app.use('/api/auth',  require('./src/routes/auth'));
app.use('/api/users', require('./src/routes/users'));

// ── 404 and error handlers ───────────────────────────────────────────────────
app.use(require('./src/middleware/notFound'));
app.use(require('./src/middleware/errorHandler'));

app.listen(PORT, () => console.log(`Server → http://localhost:${PORT}`));

Controller Pattern — Separating Logic from Routes #

// ── server/src/controllers/postController.js ──────────────────────────────────
const Post = require('../models/Post');

// @desc    Get all posts
// @route   GET /api/posts
// @access  Public
const getAllPosts = async (req, res, next) => {
  try {
    const { page = 1, limit = 10, tag, published } = req.query;
    const filter = {};
    if (tag)       filter.tags      = tag;
    if (published) filter.published = published === 'true';

    const posts = await Post.find(filter)
      .sort({ createdAt: -1 })
      .skip((page - 1) * limit)
      .limit(parseInt(limit, 10));

    res.json({ success: true, count: posts.length, data: posts });
  } catch (err) {
    next(err);
  }
};

// @desc    Get single post
// @route   GET /api/posts/:id
// @access  Public
const getPostById = async (req, res, next) => {
  try {
    const post = await Post.findById(req.params.id).populate('author', 'name avatar');
    if (!post) return res.status(404).json({ success: false, message: 'Post not found' });
    res.json({ success: true, data: post });
  } catch (err) {
    next(err);
  }
};

module.exports = { getAllPosts, getPostById }; // export all handlers

Final Project Structure #

server/
├── index.js                  ← entry point — mounts routers, starts server
├── .env
├── nodemon.json
└── src/
    ├── config/
    │   └── db.js             ← Mongoose connection
    ├── models/
    │   ├── Post.js
    │   └── User.js
    ├── controllers/
    │   ├── postController.js ← getAllPosts, getPostById, createPost...
    │   ├── authController.js ← register, login, getMe
    │   └── userController.js ← getUserProfile, updateProfile
    ├── routes/
    │   ├── posts.js          ← router.get('/', ...) router.get('/:id', ...)
    │   ├── auth.js
    │   └── users.js
    └── middleware/
        ├── auth.js           ← JWT protect middleware
        ├── notFound.js       ← 404 handler
        └── errorHandler.js   ← global error middleware

Common Mistakes #

Mistake 1 — Repeating the mount path inside the Router #

❌ Wrong — the prefix is already added by app.use():

// routes/posts.js
router.get('/api/posts',     getAllPosts);  // results in /api/posts/api/posts
router.get('/api/posts/:id', getPostById); // results in /api/posts/api/posts/:id

✅ Correct — Router paths are relative to the mount point:

router.get('/',    getAllPosts);  // matches GET /api/posts ✓
router.get('/:id', getPostById); // matches GET /api/posts/:id ✓

Mistake 2 — Putting business logic directly in route files #

❌ Wrong — database queries inside the route file blur responsibilities:

// routes/posts.js
router.get('/', async (req, res) => {
  const posts = await Post.find().sort({ createdAt: -1 }).limit(10);
  res.json(posts);
}); // route file now has business logic — hard to test, hard to reuse

✅ Correct — keep route files as thin wiring; put logic in controller files.

Mistake 3 — Forgetting to export the router #

❌ Wrong — router is never exported so index.js gets undefined:

// routes/posts.js
const router = express.Router();
router.get('/', handler);
// forgot: module.exports = router;

// index.js
app.use('/api/posts', require('./src/routes/posts')); // undefined → crash

✅ Correct — always export the router at the bottom of every route file:

module.exports = router; // ✓

Quick Reference #