Express Middleware: How next() Works, With Examples

Middleware in Express is a function with the signature (req, res, next) that runs between the moment a request arrives and the moment a response is sent. Each middleware can read or change req and res, end the request by sending a response, or call next() to hand the request to the next function in line. app.use(fn) adds middleware for every request, and Express runs everything in the order you registered it.

const express = require('express');
const app = express();

function logger(req, res, next) {
    req.startedAt = Date.now();
    console.log('1. logger:', req.method, req.url);
    next();
}

app.use(logger);

app.use((req, res, next) => {
    console.log('2. second middleware');
    next();
});

app.get('/', (req, res) => {
    console.log('3. route handler');
    res.json({ ok: true, tookMs: Date.now() - req.startedAt });
});

app.listen(3000);

The Console logs the three steps in order for every request, and the route reads req.startedAt, a property the logger added. Send GET /missing: the two middleware still log, because app.use() matches every path, and then Express answers 404 since no route matched.

Forgetting next()

A middleware that neither sends a response nor calls next() leaves the request hanging. The client waits until it times out, and nothing appears in the logs, which makes this a common middleware bug. Delete next(); from logger above and send GET / again: the request never gets an answer.

The rule is simple: every path through a middleware ends in exactly one of these:

• next() to continue,
• next(err) to jump to the error handler (see Express error handling),
• a response such as res.json() or res.status(401).send().

Calling next() after sending a response is also a bug. The next handler tries to send a second response and Express throws ERR_HTTP_HEADERS_SENT. Write return res.status(401).json(...) so the function stops there.

An auth check that stops the request

Middleware that rejects a request sends the response itself and never calls next(). Pass it as an extra argument to a route to protect only that route:

const express = require('express');
const app = express();

function requireApiKey(req, res, next) {
    if (req.get('x-api-key') !== 'secret123') {
        return res.status(401).json({ error: 'Missing or wrong API key' });
    }
    req.client = 'reporting-app';
    next();
}

app.get('/public', (req, res) => {
    res.json({ message: 'Anyone can read this' });
});

app.get('/admin/stats', requireApiKey, (req, res) => {
    res.json({ users: 42, caller: req.client });
});

// GET /admin/stats
app.listen(3000);

The first request gets 401 with {"error":"Missing or wrong API key"}. Add the header x-api-key: secret123 in the request bar and send it again: now the answer is {"users":42,"caller":"reporting-app"}. /public never runs the check.

Where middleware runs

Order is part of the meaning. A logger registered after the routes never logs requests those routes answered, because a route that sends a response does not call next(). Register app-wide middleware such as logging, body parsing and CORS first, then the routes, then the 404 and error handlers.

Built-in middleware

Express ships a few middleware functions you add with app.use(). The body parsers fill req.body; without them it is undefined.

const express = require('express');
const app = express();

app.use(express.json());
app.use(express.urlencoded());

app.get('/', (req, res) => {
    res.send('Send POST /echo with a body');
});

app.post('/echo', (req, res) => {
    res.json({ type: req.get('content-type'), body: req.body });
});

app.listen(3000);

Send POST /echo with the body {"name": "Ada"} and the answer includes "body":{"name":"Ada"}. Remove the express.json() line, send it again, and body is missing from the answer: req.body is undefined, and JSON.stringify leaves undefined values out. Packages such as cors, helmet and morgan are middleware too: you npm install them and pass them to app.use() the same way. The express.static page covers serving files.

Common mistakes

Calling the middleware instead of passing it. app.use(logger()) runs logger once at startup and registers its return value. Write app.use(logger). (express.json() has parentheses because it returns a middleware function.)

Adding the body parser after the routes. The routes run first and see req.body as undefined.

Expecting app.use('/admin', fn) to match one path. It also runs for /admin/users and every other path below /admin, for every method. To guard a single route, pass the middleware to app.get('/admin', fn, handler).