What is Middleware? The Express Request Pipeline

Middleware is the single most important concept in Express. It is the mechanism behind JSON parsing, authentication, logging, CORS, rate limiting, error handling — everything that happens to a request between the moment it arrives and the moment a response is sent. Understanding middleware deeply means you can read any Express codebase, debug request problems quickly, and compose your own reusable request processing logic. In this lesson you will learn exactly what a middleware function is, how the pipeline works, and why the order in which you register middleware is critical.

What Is Middleware? #

A middleware function is any function with access to the request object (req), the response object (res), and the next function. When called, next() passes control to the next middleware in the pipeline. When not called, the pipeline stops — the request is either responded to or left hanging.

// The middleware function signature
function myMiddleware(req, res, next) {
  // 1. Do something with req (read headers, parse body, verify token...)
  // 2. Optionally modify req or res (attach user, set headers...)
  // 3. Either:
  //    a. Call next() to pass to the next middleware / route handler
  //    b. Call res.json() / res.send() to end the request-response cycle
  //    c. Call next(err) to jump to the error handling middleware
  next();
}

The Request Pipeline — Visualised #

Incoming HTTP Request
        │
        ▼
┌───────────────────┐
│  helmet()         │  → sets security headers on res
│  next()           │
└─────────┬─────────┘
          │
          ▼
┌───────────────────┐
│  cors()           │  → adds Access-Control-Allow-Origin header
│  next()           │
└─────────┬─────────┘
          │
          ▼
┌───────────────────┐
│  morgan()         │  → logs: GET /api/posts 200 12ms
│  next()           │
└─────────┬─────────┘
          │
          ▼
┌───────────────────┐
│  express.json()   │  → parses JSON body → populates req.body
│  next()           │
└─────────┬─────────┘
          │
          ▼
┌───────────────────┐
│  protect()        │  → verifies JWT → attaches req.user
│  next() or 401    │  → if no token: res.status(401).json(...)
└─────────┬─────────┘
          │
          ▼
┌───────────────────┐
│  Route Handler    │  → queries MongoDB, sends JSON response
│  res.json(data)   │
└───────────────────┘
        │
        ▼
   HTTP Response sent to client

Three Types of Middleware in Express #

Application-Level Middleware #

const express = require('express');
const app     = express();

// Runs for EVERY request to the app, regardless of path or method
app.use((req, res, next) => {
  console.log(`${new Date().toISOString()} ${req.method} ${req.path}`);
  next();
});

// Runs for EVERY request to paths starting with /api
app.use('/api', (req, res, next) => {
  res.set('X-API-Version', '1.0');
  next();
});

// Routes are also middleware — they just end the pipeline when matched
app.get('/api/posts', (req, res) => {
  res.json({ data: [] });
});

Router-Level Middleware #

// routes/posts.js — auth middleware applies to ALL post routes
const express = require('express');
const router  = express.Router();
const protect = require('../middleware/auth');

// Apply protect middleware to ALL routes in this router
router.use(protect);

// Every route below this line requires authentication
router.get('/',    getAllPosts);
router.post('/',   createPost);
router.get('/:id', getPostById);
router.put('/:id', updatePost);

Route-Level Middleware #

// Middleware applies only to the routes where it is explicitly added
const protect          = require('../middleware/auth');
const validateObjectId = require('../middleware/validateObjectId');
const checkOwnership   = require('../middleware/checkOwnership');

// Public — no middleware
router.get('/',    getAllPosts);
router.get('/:id', validateObjectId('id'), getPostById); // validate ID only

// Protected — auth required
router.post('/',   protect, createPost);

// Protected + ownership check
router.put('/:id',    protect, validateObjectId('id'), checkOwnership, updatePost);
router.delete('/:id', protect, validateObjectId('id'), checkOwnership, deletePost);

How next() Works #

// next() — pass to next middleware/route
const logger = (req, res, next) => {
  console.log('Request received');
  next(); // ← continue pipeline
};

// next(err) — skip to error middleware
const protect = (req, res, next) => {
  if (!req.headers.authorization) {
    return next(new Error('No token')); // ← jump to error handler
  }
  next(); // ← all good, continue
};

// next('router') — skip remaining middleware in current Router
// next('route')  — skip remaining handlers for current route
// (advanced — rarely needed in standard MERN APIs)

Common Mistakes #

Mistake 1 — Registering middleware after routes that need it #

❌ Wrong — express.json() after the POST route means req.body is undefined:

app.post('/api/posts', (req, res) => {
  console.log(req.body); // undefined!
});
app.use(express.json()); // too late — registered after the route

✅ Correct — middleware must be registered before the routes that depend on it:

app.use(express.json()); // always before routes
app.post('/api/posts', handler); // req.body is now populated ✓

Mistake 2 — Calling next() after sending a response #

❌ Wrong — calling both res.json() and next() causes a “headers already sent” error:

app.use((req, res, next) => {
  res.json({ message: 'intercepted' }); // sends response
  next(); // then tries to continue pipeline — ERROR
});

✅ Correct — once a response is sent, stop pipeline execution with return:

app.use((req, res, next) => {
  if (someCondition) return res.json({ message: 'intercepted' }); // stops here
  next(); // only reaches here if condition was false
});

Mistake 3 — Forgetting next() in a middleware that should pass through #

❌ Wrong — middleware that should log and pass on, but doesn’t:

app.use((req, res, next) => {
  console.log(`${req.method} ${req.path}`);
  // forgot next() — all requests hang here
});

✅ Correct:

app.use((req, res, next) => {
  console.log(`${req.method} ${req.path}`);
  next(); // ✓
});

Quick Reference #