Sospeter Mong'are

Posted on Nov 7

Understanding Middlewares in Express.js and How They Work Internally

#node #beginners #javascript

In Node.js backend development, Express.js middlewares are the invisible engines quietly shaping every request before it reaches your route handlers. They filter, transform, validate, record, authenticate, or even terminate requests long before your controller functions come into play. Understanding how middlewares actually work under the hood is essential for writing clean, scalable, and maintainable Express applications.

This article breaks down what middlewares are, how Express executes them internally, the different types available, and why they are fundamental to modern API design.

What Exactly Is a Middleware?

In Express.js, a middleware is simply a function shaped like:

(req, res, next) => { ... }

It receives three things:

req the incoming request
res the outgoing response
next() a function that passes control to the next middleware in line

A middleware can:

read the request
modify the request
modify the response
call next() to continue the pipeline
send a response immediately and stop everything
throw an error or call next(err) to trigger error handlers

Middlewares act like checkpoints in a long hallway. Each one decides what happens next.

The Internal Mechanics: How Express Runs Middlewares

Express maintains an internal stack of middleware layers. Each time you use:

app.use(...)
app.get(...)
router.use(...)

Express stores the handler and its associated path in this stack.

When a request arrives:

Express starts at the first item in the stack.
It checks if the request path matches the middleware’s path.
If it matches, Express executes the middleware function.
The middleware runs and must call:

next() to continue
next(err) to jump to error handlers
or send a response to stop the chain
1. Express moves sequentially through the stack until:
a response is sent
or there are no more handlers

This is a chain-of-responsibility pattern: each handler gets a turn, in strict order.

Even when using async/await, Express still relies on the next() mechanism for the actual traversal of the stack.

Visualizing the Middleware Flow

Here’s a simple mental model for a request to /groups/123:

Incoming Request
  ↓
authenticateUserStrict
  ↓
checkSubscription
  ↓
checkFeatureAccessAuto
  ↓
trackApiUsage
  ↓
Route Controller (/groups/:id)
  ↓
Response Sent

Each layer is a middleware function. If any one of them decides the request should stop (e.g., invalid API key), it sends a response immediately and the rest are skipped.

Types of Middlewares in Express.js

1. Application-Level Middlewares

Bound directly to the app instance.

app.use((req, res, next) => {
  console.log('Incoming request');
  next();
});

2. Router-Level Middlewares

Scoped to routers.

const router = express.Router();
router.use(authMiddleware);

3. Built-In Middlewares

Provided by Express itself:

express.json()
express.urlencoded()

4. Third-Party Middlewares

From NPM:

cors
helmet
morgan
express-rate-limit

5. Error-Handling Middlewares

Identified by four parameters:

(err, req, res, next) => { ... }

Express jumps to these when next(err) is called.

Why Middlewares Matter

Middlewares give you an elegant way to keep your logic modular and reusable. They are commonly used for:

Authentication and authorization
API rate limiting
Logging and analytics
File uploading
Body parsing
Input validation
Role-based access control
Feature flagging
API usage tracking
Caching
Response transformation

Instead of stuffing everything into one route handler, you assemble a pipeline that handles each concern gracefully.

How Express Stores Middlewares Internally

If you inspect app._router.stack, you’ll see Express’s internal structure. Each layer looks like:

{
  route: undefined || { path, methods, stack },
  handle: function,
  name: 'middlewareName'
}

This stack is processed top to bottom for every incoming request.

Example: Middleware Pipeline in a Real API

Using your example of a group information endpoint:

app.get('/groups/:id',
  authenticateUserStrict,
  checkSubscription,
  checkFeatureAccessAuto,
  trackApiUsage,
  async (req, res) => {
    // controller logic
  }
);

Express stores these five functions in order.