Middleware

TL;DR

Middleware functions in Node.js frameworks (like Express) are functions that have access to the Request object, the Response object, and the next function in the application’s request-response cycle. They execute sequentially and can modify data, end the request, or pass control to the next middleware.

Mental Model

How It Works

When a request hits an Express server, it goes through a pipeline.
Each middleware function must do one of two things:

1. Terminate the request by sending a response (e.g., res.send(), res.json()).
2. Pass control to the next middleware by calling next().

If a middleware does neither, the request will hang forever, and the browser will eventually timeout.

Example

const express = require('express');
const app = express();

// Custom Logger Middleware
const loggerMiddleware = (req, res, next) => {
    console.log(`[${new Date().toISOString()}] ${req.method} ${req.url}`);
    next(); // Pass control to the next function
};

// Custom Auth Middleware
const authMiddleware = (req, res, next) => {
    const token = req.headers.authorization;
    if (token === 'secret') {
        req.user = { id: 1, name: 'Alice' }; // Modify the request object
        next();
    } else {
        // Terminate the request early!
        res.status(401).send('Unauthorized'); 
    }
};

// Apply globally
app.use(loggerMiddleware);

// Apply specifically to one route
app.get('/dashboard', authMiddleware, (req, res) => {
    res.send(`Welcome ${req.user.name}`);
});

Common Interview Questions

What happens if you pass an argument to next()?

If you pass any argument to next() (except the string 'route'), Express assumes it is an error. It skips all remaining regular middleware and routes, and jumps directly to the Error Handling Middleware.
next(new Error('DB Failed'));

Does middleware run on the request going in, or the response going out?

Usually on the request going in. However, you can write middleware that hooks into the response going out by listening to events on the res object (like res.on('finish', ...)), which is how logging libraries record the final HTTP status code.