EXPLAINER

Express

Express is a small Node.js library for HTTP servers: routes, middleware, and request and response objects. It is enough for many APIs. It does not include a database, auth, or a front end.

Short answer: Express is a minimal Node.js web framework: routes and middleware. Use it for a small HTTP API. Use Next.js if the React app and the server should be one project. Put secrets in environment variables, not in client code.

What it is

Express is a widely used library for writing HTTP servers on Node.js. You create an app, register routes (GET /health, POST /messages) and middleware (functions that run before your handler: logging, JSON parsing, auth). Handlers read req and write res. Express does not dictate your database, your file layout, or your front end. That smallness is the feature.

It is not Next.js, which is a React framework with opinions about rendering. It is not a Microsoft product. It is one of several Node HTTP libraries; it remains the one most examples still use. For REST habits that are larger than Express, see REST APIs for Application Development.

Why and when it is used

Use Express when you need a JSON API in Node and you want to see every layer. A backend for a React app, a webhook receiver, or a proxy that adds an API key the browser must not hold are typical. Use it to learn HTTP before you adopt a bigger framework.

Prefer Next.js when you want React routes and server components in one system. Prefer Fastify or the plain node:http module if you have a reason (performance measurements, fewer dependencies). Do not use Express to serve a giant single-page app with a custom router you invented beside it. Let the front-end host or a simple static file server do that, and keep Express for the API if that split is clearer.

How it works

A request enters the middleware stack in order. Each function can end the response or call next(). Order matters: JSON body parsing must run before a handler reads req.body. A mistake is to register an async handler that throws, and to forget an error middleware. Express does not catch rejected promises unless you wrap them or use a version and pattern that does. Unhandled async errors become hung requests or crashes.

Routers group paths. express.static serves files; be careful not to serve your repo. Mounting a router at a prefix (/api) keeps the API separate from anything else. CORS middleware is how a browser app on another origin is allowed to call you. It is not authentication.

Technologies and dependencies

Node, the express package, and usually a JSON parser that now ships with Express. TypeScript types (@types/express) if you are typed. A process manager or container to run it. Environment Variables for the port and secrets. A reverse proxy (or the platform's router) terminates TLS in production. Your database driver is separate. Frontend and Backend describes this split.

How to get started

  1. Create a Node project and install Express. Add a GET /health that returns JSON.
  2. Add express.json() and a POST that validates a field and returns 400 if it is missing. Do not trust req.body.
  3. Add an error-handling middleware with four arguments and a wrapper so async throws reach it. Test by throwing on purpose.
  4. Read the port from the environment. Start the server and hit it with curl, not only a browser.
  5. If a browser on another port will call it, add CORS for that origin only, not * with credentials.
  6. Put authentication in middleware that runs before the route, not copied into every handler.

Log the method, path and status. Do not log bodies that contain secrets or personal data.

Cautions and trade-offs

Express is unopinionated, so every codebase invents a different folder layout. Pick one and stop. The ecosystem of middleware is old; some packages are unmaintained. Read what a middleware does before you put it in front of every request.

req.body is not validated because it parsed as JSON. Validate shape (How to Validate JSON). Path parameters are strings. A catch-all error handler that returns stack traces to clients leaks internals. And Express will not scale a blocking fs.readFileSync inside a handler. Keep the loop free, and keep the process stateless so a second instance can run beside it.