DEV Community: Tanmay Gupta

Cookie Auth vs Bearer Token in Express – What's the Difference and When to Use Each?

Tanmay Gupta — Sat, 14 Jun 2025 22:10:43 +0000

When building secure Express.js applications, you’ll likely face a key architectural choice:
Should you use cookie-based authentication or bearer tokens like JWTs?

Each method has unique advantages depending on your frontend, deployment, and security requirements. In this post, we’ll break it down clearly and practically.

Why It Matters

Defines how your app handles sessions and security
Impacts frontend integration, especially for SPAs
Affects protection against attacks like CSRF and XSS
Determines whether tokens are sent automatically or manually

Option 1: Cookie-Based Authentication

How It Works

Server sets a cookie containing a session ID or JWT
Browser stores it and automatically sends it with every request — if configured correctly

res.cookie('token', jwtToken, {
  httpOnly: true,
  secure: true,
  sameSite: 'Strict'
});

To access it:

import cookieParser from 'cookie-parser';
app.use(cookieParser());

app.get('/dashboard', (req, res) => {
  const token = req.cookies.token;
});

When Are Cookies Sent Automatically?

Cookies are included in requests when:

The origin matches the cookie's domain
sameSite allows the request (Lax, Strict, or None)
credentials: 'include' is used in fetch/axios for cross-origin requests
Connection is over HTTPS if secure: true

fetch('https://api.example.com/user', {
  credentials: 'include'
});

Option 2: Bearer Token Authentication (JWT)

How It Works

Client stores token manually (e.g., in localStorage)
Token is explicitly added to the Authorization header

fetch('/api/protected', {
  headers: {
    Authorization: `Bearer ${token}`
  }
});

On the backend:

const authHeader = req.headers.authorization;
const token = authHeader?.split(' ')[1];

Cookie vs Bearer Token: Quick Comparison

Feature	Cookie Auth	Bearer Token (JWT)
Auto-sent by browser	Yes	No
Ideal for	Web apps / SSR / same-origin	APIs / mobile / cross-origin
Requires CSRF tokens	Yes (if not using `SameSite`)	No
Vulnerable to XSS	No (if `HttpOnly`)	Yes (if stored in JS)
Cross-origin support	Needs config	Easier

When to Use Which

Use Cookie Auth if:

You’re building a browser-first app (SSR or same-origin SPA)
You want session management without manually handling tokens in JS
You plan to use HttpOnly cookies for security

Use Bearer Token if:

You need to support mobile apps, external clients, or third-party integrations
You're building a fully decoupled frontend/backend
You prefer handling tokens explicitly in headers

Real-World Example: Cross-Origin Cookie Setup

Backend:

res.cookie('token', jwtToken, {
  httpOnly: true,
  secure: true,
  sameSite: 'None'
});

Frontend:

fetch('https://api.example.com/data', {
  credentials: 'include'
});

Final Thoughts

There’s no one-size-fits-all.
Cookies excel at browser-based workflows, especially when using HttpOnly and SameSite.
Bearer tokens give you flexibility, especially across different platforms or APIs.

Both are secure when implemented correctly — just make sure you understand the browser behavior, attack vectors, and configuration nuances.

Logging in Express with Morgan and Winston

Tanmay Gupta — Fri, 13 Jun 2025 19:45:08 +0000

When building a Node.js/Express app, logging is essential for debugging, monitoring, and keeping track of application behavior — both during development and in production.

In this post, we'll explore two powerful logging tools for Express:

Morgan – A lightweight HTTP request logger
Winston – A robust, customizable logger for application-level events

Why Logging Matters

Logging helps you:

Track user requests and responses
Debug server-side errors
Monitor performance and behavior in production
Audit events or suspicious activity

Morgan: HTTP Request Logger

📌 What is Morgan?

Morgan logs incoming HTTP requests in a predefined format. It's ideal for development and debugging routes.

Step 1: Install Morgan

npm install morgan

Step 2: Use Morgan in Your App

import express from 'express';
import morgan from 'morgan';

const app = express();

// Use 'dev' preset for concise logging
app.use(morgan('dev'));

app.get('/', (req, res) => {
  res.send('Hello World');
});

app.listen(3000, () => console.log('Server running'));

Output Example:

GET / 200 8.104 ms - 11

You can also use other formats like 'combined', 'short', or define your own:

app.use(morgan(':method :url :status :response-time ms'));

Winston: Flexible Application Logger

📌 What is Winston?

Winston is a general-purpose logging library. It allows you to:

Log messages to console, files, or external services
Set log levels (info, warn, error, etc.)
Format logs (JSON, timestamps, custom formats)

Step 1: Install Winston

npm install winston

Step 2: Create a Logger Configuration

Create a logger.js file:

import winston from 'winston';

const logger = winston.createLogger({
  level: 'info', // minimum level to log
  format: winston.format.combine(
    winston.format.timestamp(),
    winston.format.printf(
      ({ timestamp, level, message }) =>
        `[${timestamp}] ${level.toUpperCase()}: ${message}`
    )
  ),
  transports: [
    new winston.transports.Console(), // log to console
    new winston.transports.File({ filename: 'logs/error.log', level: 'error' }),
    new winston.transports.File({ filename: 'logs/combined.log' })
  ]
});

export default logger;

Step 3: Use Winston in Your Routes

import logger from './logger.js';

app.get('/health', (req, res) => {
  logger.info('Health check route hit');
  res.send('OK');
});

app.get('/error', (req, res) => {
  logger.error('Something went wrong');
  res.status(500).send('Error');
});

Combining Morgan with Winston

You can use Morgan to log HTTP requests and pipe those logs into Winston for consistent formatting and file storage.

import morgan from 'morgan';
import logger from './logger.js';

const stream = {
  write: (message) => logger.info(message.trim())
};

app.use(morgan('combined', { stream }));

Summary

Tool	Purpose	Best Use Case
Morgan	HTTP request logger	Log incoming HTTP requests
Winston	Application-level logger	Track custom events/errors

Final Thoughts

Use Morgan during development to trace HTTP traffic.
Use Winston in production for advanced logging, error tracking, and audit logs.
Combine both for full-stack visibility.

Handling CORS in Express

Tanmay Gupta — Thu, 12 Jun 2025 16:59:44 +0000

When building APIs with Express, you may run into a common browser security issue called CORS. This post explains what CORS is, why it matters, and how to handle it properly in your Express applications.

What is CORS?

CORS (Cross-Origin Resource Sharing) is a browser security feature that restricts requests from one origin (domain, protocol, port) to another.

For example, if your frontend is hosted on http://localhost:3000 and it tries to access an API at http://localhost:5000, the browser treats this as a cross-origin request. By default, the browser blocks such requests unless the server explicitly allows them.

When Do You See CORS Errors?

You’ll typically see an error like this in your browser console:

Access to fetch at 'http://localhost:5000/api' from origin 'http://localhost:3000' has been blocked by CORS policy.

This means the backend didn’t allow your frontend’s origin to make the request.

Solution: Use the `cors` Package in Express

Express doesn’t handle CORS by default, but the fix is simple. Just use the cors middleware.

Step 1: Install CORS

npm install cors

Step 2: Enable CORS in Your Express App

import cors from 'cors';
import express from 'express';

const app = express();

// Enable CORS for all routes
app.use(cors());

app.get('/api', (req, res) => {
  res.json({ message: 'CORS-enabled endpoint' });
});

app.listen(5000, () => {
  console.log('Server running on port 5000');
});

Customizing CORS

Want to allow only certain origins? Use options:

const corsOptions = {
  origin: 'http://localhost:3000', // Only allow this origin
  methods: ['GET', 'POST'],        // Allowed methods
  credentials: true                // Allow cookies, auth headers
};

app.use(cors(corsOptions));

You can also provide a dynamic function to control allowed origins:

const corsOptions = {
  origin: function (origin, callback) {
    const allowedOrigins = ['http://localhost:3000', 'https://myapp.com'];
    if (!origin || allowedOrigins.includes(origin)) {
      callback(null, true);
    } else {
      callback(new Error('Not allowed by CORS'));
    }
  }
};

app.use(cors(corsOptions));

CORS and Preflight Requests

When making PUT, DELETE, or requests with custom headers, the browser sends a preflight OPTIONS request to ask the server if it allows the actual request.

Make sure your server handles it:

app.options('*', cors());

Summary

Concept	Example
Allow all origins	`app.use(cors())`
Allow one origin	`origin: 'http://localhost:3000'`
Allow multiple	Use a function inside `origin`
Handle preflight	`app.options('*', cors())`

Final Thoughts

CORS can be frustrating, especially during frontend-backend development. But using the cors middleware makes it easy to:

Enable cross-origin requests
Protect your API from unwanted domains
Support cookies and custom headers

Authentication in Express Using JWT (JSON Web Tokens)

Tanmay Gupta — Tue, 10 Jun 2025 19:41:15 +0000

Securing your backend routes is crucial when building modern web applications. One of the most common and secure ways to handle authentication is by using JWT (JSON Web Tokens).

In this guide, you’ll learn:

What JWT is
How to implement login/signup
How to protect routes using tokens in an Express.js app
Adding encryption using bcryptjs to store hashed passwords

What is JWT?

JWT (JSON Web Token) is a compact, URL-safe token used to securely transmit information between parties. It has three parts:

Header – Type and algorithm
Payload – User info (e.g. ID, email)
Signature – Verifies the token's authenticity

A sample token looks like:

eyJhbGciOi... (header). (payload). (signature)

Step 1: Setup

Install required packages:

npm install express jsonwebtoken bcryptjs dotenv

Also set up your project:

npm init -y

Create a basic server.js:

import express from 'express';
import dotenv from 'dotenv';

dotenv.config();
const app = express();
app.use(express.json());

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => console.log(`Server running on port ${PORT}`));

Step 2: Mock User Database (In-Memory for Demo)

const users = []; // This would be replaced with a real database

Step 3: Signup Route (Register User)

import bcrypt from 'bcryptjs';

app.post('/signup', async (req, res) => {
  const { username, password } = req.body;

  const existing = users.find(u => u.username === username);
  if (existing) return res.status(400).json({ message: 'User already exists' });

  const hashedPassword = await bcrypt.hash(password, 10);
  users.push({ username, password: hashedPassword });

  res.status(201).json({ message: 'User registered successfully' });
});

Step 4: Login Route (Generate JWT Token)

import jwt from 'jsonwebtoken';

app.post('/login', async (req, res) => {
  const { username, password } = req.body;

  const user = users.find(u => u.username === username);
  if (!user) return res.status(400).json({ message: 'Invalid credentials' });

  const isMatch = await bcrypt.compare(password, user.password);
  if (!isMatch) return res.status(400).json({ message: 'Invalid credentials' });

  const token = jwt.sign({ username }, process.env.JWT_SECRET, {
    expiresIn: '1h'
  });

  res.json({ token });
});

.env file:

JWT_SECRET=your_jwt_secret_key

Step 5: Middleware to Protect Routes

const authenticateToken = (req, res, next) => {
  const authHeader = req.headers.authorization;
  const token = authHeader && authHeader.split(' ')[1]; // Bearer <token>

  if (!token) return res.sendStatus(401);

  jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
    if (err) return res.sendStatus(403);
    req.user = user;
    next();
  });
};

Step 6: Protected Route

app.get('/profile', authenticateToken, (req, res) => {
  res.json({ message: `Hello, ${req.user.username}!` });
});

Testing the Flow

POST /signup – Register a user
POST /login – Get JWT token
GET /profile – Add Authorization: Bearer <token> header

Summary

Endpoint	Purpose	Protected?
`POST /signup`	Register new users	❌
`POST /login`	Log in and get token	❌
`GET /profile`	Access user data	✅ (JWT)

Final Thoughts

JWT is a powerful tool for stateless authentication in Express. It’s ideal for APIs where you need to:

Validate users
Protect routes
Handle sessions without storing them server-side

Working with Route Parameters and Query Strings in Express

Tanmay Gupta — Mon, 09 Jun 2025 12:14:24 +0000

When building web applications or APIs with Express.js, it's essential to understand how to work with route parameters and query strings. These two features allow your server to respond dynamically based on values sent in the URL.

In this post, you’ll learn:

What route parameters and query strings are
How to use them in Express
Real-world examples

What Are Route Parameters?

Route parameters are parts of the URL path that are treated as variables. They are defined using a colon (:).

Example:

GET /users/123

In this case, 123 is a dynamic route parameter, typically representing a user ID.

How to Access Route Parameters in Express

app.get('/users/:id', (req, res) => {
  const userId = req.params.id;
  res.send(`User ID is ${userId}`);
});

If you visit http://localhost:3000/users/42, the server will respond with:

User ID is 42

You can also have multiple parameters:

app.get('/users/:userId/posts/:postId', (req, res) => {
  const { userId, postId } = req.params;
  res.send(`User: ${userId}, Post: ${postId}`);
});

What Are Query Strings?

Query strings are key-value pairs added to the end of a URL after a ?.

Example:

GET /search?term=express&page=2

Here:

term=express
page=2

How to Access Query Strings in Express

app.get('/search', (req, res) => {
  const { term, page } = req.query;
  res.send(`Searching for "${term}" on page ${page}`);
});

If you visit http://localhost:3000/search?term=node&page=3, the response will be:

Searching for "node" on page 3

Combining Both

You can use route parameters and query strings together.

Example:

app.get('/users/:id/details', (req, res) => {
  const userId = req.params.id;
  const { includePosts } = req.query;
  res.send(`User ID: ${userId}, Include Posts: ${includePosts}`);
});

Visit:

http://localhost:3000/users/5/details?includePosts=true

Response:

User ID: 5, Include Posts: true

Use Cases

Feature	Use Case Example
Route Parameters	`/products/:id` for product details
Query Strings	`/products?category=books&sort=price`

Summary

Feature	Syntax Example	Access in Express
Route Parameters	`/users/:id` → `/users/12`	`req.params.id`
Query Strings	`/search?term=book&page=2`	`req.query.term`, `req.query.page`

Understanding how to handle route parameters and query strings helps you build flexible, dynamic APIs and pages with Express.

Handling GET, POST, PUT, DELETE Requests in Express

Tanmay Gupta — Mon, 09 Jun 2025 08:28:55 +0000

When building APIs with Express.js, you’ll work a lot with four main types of HTTP requests:

GET – Fetch data
POST – Create new data
PUT – Update existing data
DELETE – Remove data

In this post, you’ll learn how to handle each of these request types using Express.

Project Setup (Quick Recap)

Before writing routes, make sure your Express project is set up:

mkdir express-crud-demo
cd express-crud-demo
npm init -y
npm install express

Create an index.js file:

// index.js
const express = require('express');
const app = express();

// Middleware to parse JSON
app.use(express.json());

const PORT = 3000;
app.listen(PORT, () => {
  console.log(`Server running at http://localhost:${PORT}`);
});

Sample Data (In-Memory Array)

Let’s create a fake list of users for demonstration:

let users = [
  { id: 1, name: 'Alice' },
  { id: 2, name: 'Bob' }
];

1. GET Request – Fetch All Users

app.get('/users', (req, res) => {
  res.json(users);
});

Try it:

GET http://localhost:3000/users

2. POST Request – Add a New User

app.post('/users', (req, res) => {
  const newUser = {
    id: users.length + 1,
    name: req.body.name
  };
  users.push(newUser);
  res.status(201).json(newUser);
});

Sample Request Body:

{
  "name": "Charlie"
}

3. PUT Request – Update a User

app.put('/users/:id', (req, res) => {
  const userId = parseInt(req.params.id);
  const user = users.find(u => u.id === userId);

  if (!user) {
    return res.status(404).json({ message: 'User not found' });
  }

  user.name = req.body.name;
  res.json(user);
});

Sample Request:

PUT http://localhost:3000/users/1

Body:

{
  "name": "Updated Alice"
}

4. DELETE Request – Remove a User

app.delete('/users/:id', (req, res) => {
  const userId = parseInt(req.params.id);
  const index = users.findIndex(u => u.id === userId);

  if (index === -1) {
    return res.status(404).json({ message: 'User not found' });
  }

  users.splice(index, 1);
  res.json({ message: 'User deleted successfully' });
});

Complete Example

Here’s the full version of index.js with all routes:

const express = require('express');
const app = express();
app.use(express.json());

let users = [
  { id: 1, name: 'Alice' },
  { id: 2, name: 'Bob' }
];

app.get('/users', (req, res) => {
  res.json(users);
});

app.post('/users', (req, res) => {
  const newUser = {
    id: users.length + 1,
    name: req.body.name
  };
  users.push(newUser);
  res.status(201).json(newUser);
});

app.put('/users/:id', (req, res) => {
  const userId = parseInt(req.params.id);
  const user = users.find(u => u.id === userId);
  if (!user) return res.status(404).json({ message: 'User not found' });
  user.name = req.body.name;
  res.json(user);
});

app.delete('/users/:id', (req, res) => {
  const userId = parseInt(req.params.id);
  const index = users.findIndex(u => u.id === userId);
  if (index === -1) return res.status(404).json({ message: 'User not found' });
  users.splice(index, 1);
  res.json({ message: 'User deleted successfully' });
});

const PORT = 3000;
app.listen(PORT, () => {
  console.log(`Server is running at http://localhost:${PORT}`);
});

Summary

HTTP Method	Purpose	Route Example
GET	Read data	`/users`
POST	Create data	`/users`
PUT	Update data	`/users/:id`
DELETE	Delete data	`/users/:id`

With this basic CRUD setup, you're ready to build REST APIs using Express.

Using ECMAScript Modules (ESM) Instead of CommonJS in Node.js

Tanmay Gupta — Sun, 08 Jun 2025 08:05:32 +0000

By default, most Node.js projects use CommonJS syntax (require, module.exports). But modern JavaScript has standardized ES Modules (ESM), which use import and export statements, just like in frontend development.

In this post, you’ll learn:

The difference between CommonJS and ESM
How to set up ESM in a Node.js + Express app
How to write modern import/export syntax

Why Use ESM?

ESM is the official module system in modern JavaScript. Benefits include:

Cleaner, standard syntax (import / export)
Top-level await support (await without async function wrapper)
Shared syntax with frontend JavaScript (React, Vue, etc.)
Future-proofing for new features

Step 1: Tell Node.js to Use Modules

In your package.json, add:

{
  "type": "module"
}

This tells Node.js to treat .js files as ES modules.

Step 2: Convert `require` to `import`

Here’s a CommonJS example:

const express = require('express');
const mongoose = require('mongoose');
const connectDB = require('./config/db');

Converted to ESM:

import express from 'express';
import mongoose from 'mongoose';
import connectDB from './config/db.js'; // .js extension is required

⚠️ Important: You must include file extensions like .js in relative imports with ESM.

Step 3: Convert `module.exports` to `export default`

In CommonJS:

module.exports = connectDB;

In ESM:

export default connectDB;

You can also export multiple named items:

export const greet = () => console.log('Hi');
export const sayBye = () => console.log('Bye');

And import them like this:

import connectDB from '../config/db.js'; // default import can be named anything
import { greet, sayBye } from './utils.js';

Step 4: Update All Files

Here’s an example of a basic Express server with ESM:

// server.js
import express from 'express';
import dotenv from 'dotenv';
import connectDB from './config/db.js';
import postRoutes from './routes/postRoutes.js';

dotenv.config();
connectDB();

const app = express();
app.use(express.json());

app.use('/api/posts', postRoutes);

const PORT = process.env.PORT || 5000;
app.listen(PORT, () => {
  console.log(`Server running on http://localhost:${PORT}`);
});

When Should You Use ESM?

Use ESM if:

You want modern syntax and top-level await
You work with frontend frameworks that use ESM
You’re starting a new project or using newer libraries that support it

Use CommonJS if:

You’re working on an older Node.js codebase
You rely on older packages that don’t support ESM yet

Summary

Feature	CommonJS	ESM (Modules)
Import	`require()`	`import from`
Export	`module.exports`	`export` / `export default`
File extensions	Optional	Required (`.js`, `.json`)

Using ESM makes your codebase cleaner, consistent with modern JavaScript, and ready for future features.

Building Basic CRUD Routes in Express with MongoDB

Tanmay Gupta — Sat, 07 Jun 2025 19:40:18 +0000

Starting with what actually backend does... CRUD!!

CRUD stands for:

Create → Add new data
Read → Retrieve existing data
Update → Modify existing data
Delete → Remove data

This guide will walk you through implementing basic CRUD operations using Express.js and Mongoose.

Step 1: Define a Mongoose Model

Create a file at src/models/Post.js:

const mongoose = require('mongoose');

const postSchema = new mongoose.Schema({
  title: "{"
    type: String,
    required: true
  },
  body: {
    type: String,
    required: true
  }
}, { timestamps: true });

module.exports = mongoose.model('Post', postSchema);

Step 2: Create Controller Functions

Create a file at src/controllers/postController.js:

const Post = require('../models/Post');

// Create a new post
exports.createPost = async (req, res) => {
  try {
    const post = new Post(req.body);
    const saved = await post.save();
    res.status(201).json(saved);
  } catch (err) {
    res.status(400).json({ error: err.message });
  }
};

// Get all posts
exports.getAllPosts = async (req, res) => {
  try {
    const posts = await Post.find();
    res.json(posts);
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
};

// Get a single post by ID
exports.getPostById = async (req, res) => {
  try {
    const post = await Post.findById(req.params.id);
    if (!post) return res.status(404).json({ error: 'Post not found' });
    res.json(post);
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
};

// Update a post
exports.updatePost = async (req, res) => {
  try {
    const updated = await Post.findByIdAndUpdate(req.params.id, req.body, {
      new: true,
      runValidators: true
    });
    if (!updated) return res.status(404).json({ error: 'Post not found' });
    res.json(updated);
  } catch (err) {
    res.status(400).json({ error: err.message });
  }
};

// Delete a post
exports.deletePost = async (req, res) => {
  try {
    const deleted = await Post.findByIdAndDelete(req.params.id);
    if (!deleted) return res.status(404).json({ error: 'Post not found' });
    res.json({ message: 'Post deleted successfully' });
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
};

Step 3: Define the Routes

Create a file at src/routes/postRoutes.js:

const express = require('express');
const router = express.Router();
const postController = require('../controllers/postController');

router.post('/', postController.createPost);
router.get('/', postController.getAllPosts);
router.get('/:id', postController.getPostById);
router.put('/:id', postController.updatePost);
router.delete('/:id', postController.deletePost);

module.exports = router;

Step 4: Mount the Routes in `app.js`

Update your src/app.js or server.js:

const express = require('express');
const app = express();
const postRoutes = require('./routes/postRoutes');

app.use(express.json());
app.use('/api/posts', postRoutes);

module.exports = app;

Testing the Routes

You can test these routes using tools like:

Postman
cURL
A frontend UI

Endpoints:

POST /api/posts – Create a post
GET /api/posts – Get all posts
GET /api/posts/:id – Get post by ID
PUT /api/posts/:id – Update post
DELETE /api/posts/:id – Delete post

Example request body for creating a post:

{
  "title": "First Blog Post",
  "body": "This is the content of the blog post."
}

Summary

You now have:

A Mongoose model (Post)
Controller functions for handling logic
Express routes for handling HTTP requests
A working CRUD API

This pattern keeps your code modular, scalable, and easy to maintain.

Connecting Express to MongoDB with Mongoose, .env, and .gitignore

Tanmay Gupta — Thu, 05 Jun 2025 20:07:37 +0000

As you build more powerful Express apps, connecting to a database becomes essential. In this blog, we’ll walk through how to:

Connect an Express app to MongoDB using Mongoose
Secure your credentials using .env
Prevent sensitive files from being tracked with .gitignore

Let’s get started.

Step 1: Install Required Packages

In your project directory, install:

npm install mongoose dotenv

mongoose: ODM (Object Data Modeling) library for MongoDB
dotenv: Loads environment variables from .env files

Step 2: Create `.env` File

In the root of your project, create a .env file:

touch .env

Add your MongoDB connection string:

MONGO_URI=mongodb+srv://<username>:<password>@cluster.mongodb.net/myDatabase
PORT=5000

Never share this file publicly.

Step 3: Setup `.gitignore`

To ensure .env and other sensitive files aren’t committed to Git, create a .gitignore file:

touch .gitignore

Add this to .gitignore:

node_modules/
.env

Now Git will ignore node_modules (which can be reinstalled) and .env (which is sensitive).

Step 4: Create MongoDB Config

Create a file at src/config/db.js:

const mongoose = require('mongoose');

const connectDB = async () => {
  try {
    await mongoose.connect(process.env.MONGO_URI);
    console.log('MongoDB connected successfully');
  } catch (error) {
    console.error('MongoDB connection failed:', error.message);
    process.exit(1);
  }
};

module.exports = connectDB;

Step 5: Use `dotenv` and Connect DB

Update your server.js or app.js:

// server.js
const dotenv = require('dotenv');
dotenv.config(); // Load .env before anything else

const express = require('express');
const connectDB = require('./src/config/db');

const app = express();

// Connect to MongoDB
connectDB();

// Middleware
app.use(express.json());

// Routes
app.get('/', (req, res) => {
  res.send('Server running with MongoDB');
});

const PORT = process.env.PORT || 5000;
app.listen(PORT, () => {
  console.log(`Server is running on http://localhost:${PORT}`);
});

Final Folder Snapshot

my-express-app/
├── node_modules/
├── src/
│   └── config/
│       └── db.js
├── .env
├── .gitignore
├── package.json
└── server.js

Step 6: Run Your App

Start the server:

node server.js

If successful, you’ll see:

MongoDB connected successfully
Server is running on http://localhost:5000

Bonus Tip: Use Environment Variables in Production

When you deploy (e.g., to Render or Vercel), add your MONGO_URI and PORT values to their dashboard under Environment Variables — no need to upload .env.

Summary

Use mongoose to connect MongoDB with Express
Use .env to store private credentials safely
Use .gitignore to prevent committing sensitive files
Never share .env or node_modules in Git

You now have a secure and scalable MongoDB connection in your Express app.

Express.js Folder Structure Explained

Tanmay Gupta — Wed, 04 Jun 2025 15:31:38 +0000

When you're just starting out with Express.js, it's easy to write everything in a single file like index.js. But as your application grows, this quickly becomes hard to manage.

That’s why a clean and scalable folder structure is crucial.

In this blog post, you’ll learn:

Why folder structure matters
A standard way to organize an Express app
What each folder/file does

Why Organize?

A good project structure:

Makes your code readable
Keeps logic separated
Helps you scale easily
Makes debugging and testing simpler

Basic Express Folder Structure

Here’s a recommended folder structure for a moderate-sized Express app:

my-express-app/
├── node_modules/
├── src/
│   ├── controllers/
│   ├── routes/
│   ├── models/
│   ├── middleware/
│   ├── config/
│   ├── utils/
│   └── app.js
├── .env
├── package.json
└── server.js

`src/` — Main App Folder

This folder holds all your actual source code. Inside it:

`controllers/`

This folder contains your business logic. Each file typically handles a specific route or resource.

// src/controllers/userController.js
exports.getUsers = (req, res) => {
  res.send('List of users');
};

`routes/`

This is where you define Express routes and connect them to controllers.

// src/routes/userRoutes.js
const express = require('express');
const router = express.Router();
const userController = require('../controllers/userController');

router.get('/users', userController.getUsers);

module.exports = router;

`models/`

Used for database models. You might use Mongoose for MongoDB or Sequelize for SQL.

// src/models/User.js
const mongoose = require('mongoose');

const UserSchema = new mongoose.Schema({
  name: String,
  email: String,
});

module.exports = mongoose.model('User', UserSchema);

`middleware/`

Custom middleware functions like authentication, logging, error handling, etc.

// src/middleware/logger.js
const logger = (req, res, next) => {
  console.log(`${req.method} ${req.url}`);
  next();
};

module.exports = logger;

`config/`

Store configuration files like DB connection, environment setup, constants.

// src/config/db.js
const mongoose = require('mongoose');

const connectDB = async () => {
  await mongoose.connect(process.env.MONGO_URI);
  console.log('MongoDB connected');
};

module.exports = connectDB;

`utils/`

Helper functions and utilities (e.g., validators, formatters, token generators).

// src/utils/generateToken.js
const jwt = require('jsonwebtoken');

const generateToken = (id) => {
  return jwt.sign({ id }, process.env.JWT_SECRET, { expiresIn: '1d' });
};

module.exports = generateToken;

`app.js`

This is where you configure Express and mount all routes & middleware.

const express = require('express');
const userRoutes = require('./routes/userRoutes');
const logger = require('./middleware/logger');

const app = express();

app.use(express.json());
app.use(logger);
app.use('/api', userRoutes);

module.exports = app;

`server.js`

Entry point of the app. Responsible for starting the server.

const app = require('./src/app');
const dotenv = require('dotenv');
dotenv.config();

const PORT = process.env.PORT || 5000;

app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});

`.env`

Environment variables like:

PORT=5000
MONGO_URI=mongodb+srv://...
JWT_SECRET=mysecretkey

Use the dotenv package to access these in your app.

Benefits of This Structure

Clear separation of concerns
Easier testing and debugging
Scales well with team collaboration
Ready for features like logging, authentication, APIs, etc.

Next Steps

Now that you have a solid structure, you can:

Add authentication
Connect a database
Deploy to Render, Vercel, or Heroku
Use Postman to test your APIs

TL;DR

Keep your code clean by:

Separating files by purpose
Moving configs and middleware to their own places
Treating your src folder as the app’s core

💡 Pro tip: You don’t need to use this full structure on day one. Start simple and refactor as your app grows.

Happy coding 👨‍💻👩‍💻

Creating Your First Express server

Tanmay Gupta — Mon, 02 Jun 2025 09:42:48 +0000

So you’ve heard of Express.js, the minimalist web framework for Node.js, and you’re ready to build your first backend server. Whether you're working on an API, a web app, or just want to learn backend basics, this blog post will guide you through creating your first Express server—step by step.

Prerequisites

Before we begin, make sure you have:

Node.js installed (v14+ recommended)
A code editor (like VS Code)
Basic knowledge of JavaScript

You can download Node.js from https://nodejs.org

Step 1: Create Your Project Directory

Open your terminal and run:
Or simply create and open that folder in vscode

mkdir my-express-server
cd my-express-server

Initialize a Node.js project:

npm init -y

This will create a package.json file with default settings.

Step 2: Installing Express

Now, install Express npm package:

npm install express

Step 3: Create Your Server File

Create a file named index.js:
or just create a new file in vscode using new file option

touch index.js

Step 4: Set Up the Server

In index.js, add the following code:

const express = require('express'); // requiring express
const app = express(); // create instance of express
const PORT = 3000; // port on which the server will run

// Root route
app.get('/', (req, res) => {
  res.send('Hello World! Your Express server is running 🎉');
});

// Start the server
// Listening to any requests that come on the defined PORT
app.listen(PORT, () => {
  console.log(`Server is running at http://localhost:${PORT}`);
});

Step 5: Run Your Server

In the terminal, run:

node index.js

If everything is set up correctly, you'll see:

Server is running at http://localhost:3000

Now open your browser and navigate to http://localhost:3000. You should see:

Hello World! Your Express server is running 🎉

Bonus: Use Nodemon for Auto-Restarts

Manually restarting the server every time you make a change can get annoying. Install nodemon for convenience:

npm install --save-dev nodemon

Update your package.json scripts:

"scripts": {
  "start": "node index.js",
  "dev": "nodemon index.js"
}

Now run:

npm run dev

Summary

In this tutorial, you:

Created a new Node.js project
Installed Express
Wrote a basic server
Tested it in the browser
(Optionally) used Nodemon for auto-restarts

DEV Community: Tanmay Gupta

Cookie Auth vs Bearer Token in Express – What's the Difference and When to Use Each?

Why It Matters

Option 1: Cookie-Based Authentication

How It Works

When Are Cookies Sent Automatically?

Option 2: Bearer Token Authentication (JWT)

How It Works

Cookie vs Bearer Token: Quick Comparison

When to Use Which

Real-World Example: Cross-Origin Cookie Setup

Final Thoughts

Logging in Express with Morgan and Winston

Why Logging Matters

Morgan: HTTP Request Logger

📌 What is Morgan?

Step 1: Install Morgan

Step 2: Use Morgan in Your App

Output Example:

Winston: Flexible Application Logger

📌 What is Winston?

Step 1: Install Winston

Step 2: Create a Logger Configuration

Step 3: Use Winston in Your Routes

Combining Morgan with Winston

Summary

Final Thoughts

Handling CORS in Express

What is CORS?

When Do You See CORS Errors?

Solution: Use the cors Package in Express

Step 1: Install CORS

Step 2: Enable CORS in Your Express App

Customizing CORS

CORS and Preflight Requests

Summary

Final Thoughts

Authentication in Express Using JWT (JSON Web Tokens)

What is JWT?

Step 1: Setup

Step 2: Mock User Database (In-Memory for Demo)

Step 3: Signup Route (Register User)

Step 4: Login Route (Generate JWT Token)

Step 5: Middleware to Protect Routes

Step 6: Protected Route

Testing the Flow

Summary

Final Thoughts

Working with Route Parameters and Query Strings in Express

What Are Route Parameters?

How to Access Route Parameters in Express

What Are Query Strings?

How to Access Query Strings in Express

Combining Both

Use Cases

Summary

Handling GET, POST, PUT, DELETE Requests in Express

Project Setup (Quick Recap)

Sample Data (In-Memory Array)

1. GET Request – Fetch All Users

Try it:

2. POST Request – Add a New User

Sample Request Body:

3. PUT Request – Update a User

Sample Request:

Body:

4. DELETE Request – Remove a User

Complete Example

Summary

Using ECMAScript Modules (ESM) Instead of CommonJS in Node.js

Why Use ESM?

Step 1: Tell Node.js to Use Modules

Step 2: Convert require to import

Step 3: Convert module.exports to export default

Step 4: Update All Files

When Should You Use ESM?

Summary

Building Basic CRUD Routes in Express with MongoDB

Step 1: Define a Mongoose Model

Step 2: Create Controller Functions

Solution: Use the `cors` Package in Express

Step 2: Convert `require` to `import`

Step 3: Convert `module.exports` to `export default`

Step 4: Mount the Routes in `app.js`

Step 2: Create `.env` File

Step 3: Setup `.gitignore`

Step 5: Use `dotenv` and Connect DB

`src/` — Main App Folder

`controllers/`

`routes/`

`models/`

`middleware/`

`config/`

`utils/`

`app.js`

`server.js`

`.env`