Express.js is a minimal, unopinionated web framework built on top of Node.js's HTTP module. It abstracts the complexities of server-side network programming while maintaining the flexibility and performance characteristics that make Node.js valuable.

Technical relationship with Node.js:

• HTTP module extension: Express builds upon and extends Node's native http module capabilities
• Middleware architecture: Express implements the middleware pattern as a first-class concept
• Event-driven design: Express preserves Node's non-blocking I/O event loop model
• Single-threaded performance: Like Node.js, Express optimizes for event loop utilization rather than thread-based concurrency

Architectural benefits:

Express provides several core abstractions that complement Node.js:

• Router: Modular request routing with support for HTTP verbs, path parameters, and patterns
• Middleware pipeline: Request/response processing through a chain of functions with next() flow control
• Application instance: Centralized configuration with environment-specific settings
• Response helpers: Methods for common response patterns (json(), sendFile(), render())

const express = require('express');
const app = express();

// Middleware for request logging
app.use((req, res, next) => {
  console.log(`${req.method} ${req.url} at ${new Date().toISOString()}`);
  next(); // Passes control to the next middleware function
});

// Middleware for CORS headers
app.use((req, res, next) => {
  res.header('Access-Control-Allow-Origin', '*');
  res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept');
  next();
});

// Route handler middleware
app.get('/api/data', (req, res) => {
  res.json({ message: 'Data retrieved successfully' });
});

// Error handling middleware (4 parameters)
app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(500).send('Something broke!');
});

app.listen(3000);
        

Performance considerations:

• Express inherits Node's event loop limitations for CPU-bound tasks
• Middleware ordering can significantly impact application performance
• Static file serving should typically be handled by a separate web server (Nginx, CDN) in production
• Clustering (via Node's cluster module or PM2) remains necessary for multi-core utilization

Setting up an Express.js application involves both essential configuration and architectural decisions that affect scalability, maintainability, and performance. Here's a comprehensive approach:

1. Project Initialization and Dependency Management

mkdir express-application
cd express-application
npm init -y
npm install express
npm install --save-dev nodemon
    

Consider installing these common production dependencies:

npm install dotenv            # Environment configuration
npm install helmet            # Security headers
npm install compression       # Response compression
npm install morgan            # HTTP request logging
npm install cors              # Cross-origin resource sharing
npm install express-validator # Request validation
npm install http-errors       # HTTP error creation
    

2. Project Structure for Scalability

A maintainable Express application follows separation of concerns:

express-application/
├── config/                 # Application configuration
│   ├── db.js              # Database configuration
│   └── environment.js     # Environment variables setup
├── controllers/           # Request handlers
│   ├── userController.js
│   └── productController.js
├── middleware/            # Custom middleware
│   ├── errorHandler.js
│   ├── authenticate.js
│   └── validate.js
├── models/                # Data models
│   ├── userModel.js
│   └── productModel.js
├── routes/                # Route definitions
│   ├── userRoutes.js
│   └── productRoutes.js
├── services/              # Business logic
│   ├── userService.js
│   └── productService.js
├── utils/                 # Utility functions
│   └── helpers.js
├── public/                # Static assets
├── views/                 # Template files (if using server-side rendering)
├── tests/                 # Unit and integration tests
├── app.js                 # Application entry point
├── server.js              # Server initialization
├── package.json
└── .env                   # Environment variables (not in version control)
    

3. Application Core Configuration

Here's how app.js should be structured for a production-ready application:

// app.js
const express = require('express');
const path = require('path');
const helmet = require('helmet');
const compression = require('compression');
const cors = require('cors');
const morgan = require('morgan');
const createError = require('http-errors');
require('dotenv').config();

// Initialize express app
const app = express();

// Security, CORS, compression middleware
app.use(helmet());
app.use(cors());
app.use(compression());

// Request parsing middleware
app.use(express.json());
app.use(express.urlencoded({ extended: false }));

// Logging middleware
app.use(morgan(process.env.NODE_ENV === 'production' ? 'combined' : 'dev'));

// Static file serving
app.use(express.static(path.join(__dirname, 'public')));

// Routes
const userRoutes = require('./routes/userRoutes');
const productRoutes = require('./routes/productRoutes');

app.use('/api/users', userRoutes);
app.use('/api/products', productRoutes);

// Catch 404 and forward to error handler
app.use((req, res, next) => {
  next(createError(404, 'Resource not found'));
});

// Error handling middleware
app.use((err, req, res, next) => {
  // Set locals, only providing error in development
  res.locals.message = err.message;
  res.locals.error = process.env.NODE_ENV === 'development' ? err : {};

  // Send error response
  res.status(err.status || 500);
  res.json({
    error: {
      message: err.message,
      status: err.status || 500
    }
  });
});

module.exports = app;
    

4. Server Initialization (Separated from App Config)

// server.js
const app = require('./app');
const http = require('http');

// Normalize port value
const normalizePort = (val) => {
  const port = parseInt(val, 10);
  if (isNaN(port)) return val;
  if (port >= 0) return port;
  return false;
};

const port = normalizePort(process.env.PORT || '3000');
app.set('port', port);

// Create HTTP server
const server = http.createServer(app);

// Handle specific server errors
server.on('error', (error) => {
  if (error.syscall !== 'listen') {
    throw error;
  }

  const bind = typeof port === 'string' ? 'Pipe ' + port : 'Port ' + port;

  // Handle specific listen errors with friendly messages
  switch (error.code) {
    case 'EACCES':
      console.error(bind + ' requires elevated privileges');
      process.exit(1);
      break;
    case 'EADDRINUSE':
      console.error(bind + ' is already in use');
      process.exit(1);
      break;
    default:
      throw error;
  }
});

// Start listening
server.listen(port);
server.on('listening', () => {
  const addr = server.address();
  const bind = typeof addr === 'string' ? 'pipe ' + addr : 'port ' + addr.port;
  console.log('Listening on ' + bind);
});
    

5. Route Module Example

// routes/userRoutes.js
const express = require('express');
const router = express.Router();
const userController = require('../controllers/userController');
const { authenticate } = require('../middleware/authenticate');
const { validateUser } = require('../middleware/validate');

router.get('/', userController.getAllUsers);
router.get('/:id', userController.getUserById);
router.post('/', validateUser, userController.createUser);
router.put('/:id', authenticate, validateUser, userController.updateUser);
router.delete('/:id', authenticate, userController.deleteUser);

module.exports = router;
    

6. Performance Considerations

• Environment-specific configuration: Use environment variables for different stages (dev/prod)
• Connection pooling: For database connections, use pooling to manage resources efficiently
• Response compression: Compress responses to reduce bandwidth usage
• Proper error handling: Implement consistent error handling across the application
• Clustering: Utilize Node.js cluster module or PM2 for multi-core systems

7. Running the Application

Add these scripts to package.json:

"scripts": {
  "start": "NODE_ENV=production node server.js",
  "dev": "nodemon server.js",
  "test": "jest"
}
    

Express.js routing is a middleware system that dispatches HTTP requests to specific handler functions based on the HTTP method and URL path. At its core, Express routing creates a routing table mapping URL patterns to callback functions.

Route Dispatching Architecture:

Internally, Express uses a Trie data structure (a prefix tree) to efficiently match routes, optimizing the lookup process even with numerous routes defined.

const express = require('express');
const app = express();
const router = express.Router();

// Basic method-based routing
app.get('/', (req, res) => { /* ... */ });
app.post('/', (req, res) => { /* ... */ });

// Route chaining
app.route('/books')
  .get((req, res) => { /* GET handler */ })
  .post((req, res) => { /* POST handler */ })
  .put((req, res) => { /* PUT handler */ });

// Router modules for modular route handling
router.get('/users', (req, res) => { /* ... */ });
app.use('/api', router); // Mount router at /api prefix
        

Middleware Chain Execution:

Each route can include multiple middleware functions that execute sequentially:

app.get('/profile',
  // Authentication middleware
  (req, res, next) => {
    if (!req.isAuthenticated()) return res.status(401).send('Not authorized');
    next();
  },
  // Authorization middleware
  (req, res, next) => {
    if (!req.user.canViewProfile) return res.status(403).send('Forbidden');
    next();
  },
  // Final handler
  (req, res) => {
    res.send('Profile data');
  }
);
    

Route Parameter Processing:

Express parses route parameters with sophisticated pattern matching:

• Named parameters: /users/:userId
• Optional parameters: /users/:userId?
• Regular expression constraints: /users/:userId([0-9]{6})

// Parameter middleware (executes for any route with :userId)
app.param('userId', (req, res, next, id) => {
  // Fetch user from database
  User.findById(id)
    .then(user => {
      if (!user) return res.status(404).send('User not found');
      req.user = user; // Attach to request object
      next();
    })
    .catch(next);
});

// Now all routes with :userId will have req.user already populated
app.get('/users/:userId', (req, res) => {
  res.json(req.user);
});
        

Wildcard and Pattern Matching:

Express supports path patterns using string patterns and regular expressions:

// Match paths starting with "ab" followed by "cd"
app.get('/ab*cd', (req, res) => { /* ... */ });

// Match paths using regular expressions
app.get(/\/users\/(\d+)/, (req, res) => {
  const userId = req.params[0]; // Capture group becomes first param
  res.send(`User ID: ${userId}`);
});
    

Performance Considerations:

For high-performance applications:

• Order routes from most specific to most general for optimal matching speed
• Use express.Router() to modularize routes and improve maintainability
• Implement caching strategies for frequently accessed routes
• Consider using router.use(express.json({ limit: '1mb' })) to prevent payload attacks

Express.js provides support for all standard HTTP methods defined in the HTTP/1.1 specification through its routing system. The framework implements these methods following RESTful principles and the HTTP protocol semantics.

HTTP Method Implementation in Express:

Express provides method-specific functions that map directly to HTTP methods:

// Common method handlers
app.get(path, callback)
app.post(path, callback)
app.put(path, callback)
app.delete(path, callback)
app.patch(path, callback)
app.options(path, callback)
app.head(path, callback)

// Generic method handler (can be used for any HTTP method)
app.all(path, callback)

// For less common methods
app.method('PURGE', path, callback) // For custom methods
    

HTTP Method Semantics and Implementation Details:

Advanced Method Handling:

const methodOverride = require('method-override');

// Allow HTTP method override with _method query parameter
app.use(methodOverride('_method'));

// Now a request to /users/123?_method=DELETE will be treated as DELETE
// even if the actual HTTP method is POST
        

Content Negotiation and Method Handling:

app.put('/api/users/:id', (req, res) => {
  // Check content type for appropriate processing
  if (req.is('application/json')) {
    // Process JSON data
  } else if (req.is('application/x-www-form-urlencoded')) {
    // Process form data
  } else {
    return res.status(415).send('Unsupported Media Type');
  }
  
  // Respond with appropriate format based on Accept header
  res.format({
    'application/json': () => res.json({ success: true }),
    'text/html': () => res.send('<p>Success</p>'),
    default: () => res.status(406).send('Not Acceptable')
  });
});
    

Security Considerations:

• CSRF Protection: POST, PUT, DELETE, and PATCH methods require CSRF protection
• Idempotency Keys: For non-idempotent methods (POST, PATCH), consider implementing idempotency keys to prevent duplicate operations
• Rate Limiting: Apply stricter rate limits on state-changing methods (non-GET)

// Apply CSRF protection only to state-changing methods
app.use((req, res, next) => {
  const stateChangingMethods = ['POST', 'PUT', 'DELETE', 'PATCH'];
  if (stateChangingMethods.includes(req.method)) {
    return csrfProtection(req, res, next);
  }
  next();
});
        

HTTP/2 and HTTP/3 Considerations:

With newer HTTP versions, the semantics of HTTP methods remain the same, but consider:

• Server push capabilities with GET requests
• Multiplexing affects how concurrent requests with different methods are handled
• Header compression changes how metadata is transmitted

Middleware in Express.js is a fundamental architectural pattern that enables modular, composable request processing. It provides a pipeline-based approach to handling HTTP requests and responses, where each middleware function has the capacity to execute code, modify request and response objects, end the request-response cycle, or call the next middleware in the stack.

Middleware Execution Flow:

Express middleware follows a sequential execution model defined by the order of registration. The middleware stack is traversed in a first-in-first-out manner until either a middleware terminates the response or the stack is fully processed.

function middleware(req, res, next) {
  // 1. Perform operations on req and res objects
  req.customData = { processed: true };
  
  // 2. Execute any necessary operations
  const startTime = Date.now();
  
  // 3. Call next() to pass control to the next middleware
  next();
  
  // 4. Optionally perform operations after next middleware completes
  console.log(`Request processing time: ${Date.now() - startTime}ms`);
}

app.use(middleware);
        

Error-Handling Middleware:

Express distinguishes between regular and error-handling middleware through function signature. Error handlers take four parameters instead of three:

app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(500).send('Something broke!');
});
    

Middleware Scoping and Mounting:

Middleware can be applied at different scopes:

• Application-level: app.use(middleware) - Applied to all routes
• Router-level: router.use(middleware) - Applied to a specific router instance
• Route-level: app.get('/path', middleware, handler) - Applied to a specific route
• Subpath mounting: app.use('/api', middleware) - Applied only to paths that start with the specified path segment

Middleware Chain Termination:

A middleware can terminate the request-response cycle by:

• Calling res.end(), res.send(), res.json(), etc.
• Not calling next() (intentionally ending the chain)
• Calling next() with an error parameter, which jumps to error-handling middleware

Middleware Execution Context:

Middleware execution occurs within the context of a Node.js event loop iteration. Blocking operations in middleware can affect the application's ability to handle concurrent requests, making asynchronous patterns crucial for performance.

Internals:

Under the hood, Express maintains a middleware stack as an array of layer objects, each containing a path pattern, the middleware function, and metadata. When a request arrives, Express creates a dispatch chain by matching the request path against each layer, then executes the chain sequentially.

Express.js provides several built-in middleware functions that handle common HTTP processing requirements. Understanding their internal mechanisms, configuration options, and edge cases is essential for building robust web applications.

Core Built-in Middleware Components:

// Advanced configuration of express.json()
app.use(express.json({
  limit: '1mb',        // Maximum request body size
  strict: true,        // Only accept arrays and objects
  inflate: true,       // Handle compressed bodies
  reviver: (key, value) => {
    // Custom JSON parsing logic
    return typeof value === 'string' ? value.trim() : value;
  },
  type: ['application/json', 'application/vnd.api+json']  // Content types to process
}));
    

// Advanced static file serving configuration
app.use(express.static('public', {
  dotfiles: 'ignore',       // How to handle dotfiles
  etag: true,                // Enable/disable etag generation
  extensions: ['html', 'htm'], // Try these extensions for extensionless URLs
  fallthrough: true,         // Fall through to next handler if file not found
  immutable: false,          // Add immutable directive to Cache-Control header
  index: 'index.html',       // Directory index file
  lastModified: true,        // Set Last-Modified header
  maxAge: '1d',              // Cache-Control max-age in milliseconds or string
  setHeaders: (res, path, stat) => {
    // Custom header setting function
    if (path.endsWith('.pdf')) {
      res.set('Content-Disposition', 'attachment');
    }
  }
}));
    

Lesser-Known Built-in Middleware:

• express.text(): Parses text bodies with options for character set detection and size limits.
• express.raw(): Handles binary data streams, useful for WebHooks or binary protocol implementations.
• express.Router(): Creates a mountable middleware system that follows the middleware design pattern itself, supporting route-specific middleware stacks.

Implementation Details and Performance Considerations:

Express middleware internally uses a technique called middleware chaining. Each middleware function is wrapped in a higher-order function that manages the middleware stack. The implementation uses a simple linked-list-like approach where each middleware maintains a reference to the next middleware in the chain.

Performance-wise, the body parsing middleware (json, urlencoded) should be applied selectively to routes that actually require body parsing rather than globally, as they add processing overhead to every request. The static middleware employs file system caching mechanisms to reduce I/O overhead for frequently accessed resources.

// Conditionally apply middleware based on content-type
app.use((req, res, next) => {
  const contentType = req.get('Content-Type') || '';
  
  if (contentType.includes('application/json')) {
    express.json()(req, res, next);
  } else if (contentType.includes('application/x-www-form-urlencoded')) {
    express.urlencoded({ extended: true })(req, res, next);
  } else {
    next();
  }
});
    

Security Implications:

The body parsing middleware can be exploited for DoS attacks through large payloads or deeply nested JSON objects. Configure appropriate limits and use a security middleware like Helmet in conjunction with Express's built-in middleware to mitigate common web vulnerabilities.

The request and response objects in Express.js are enhanced versions of Node.js's native HTTP module objects, providing a more developer-friendly API for handling HTTP interactions:

Request Object (req) Internals:

The request object is an enhanced version of Node.js's IncomingMessage object with additional properties and methods added by Express and its middleware.

• Core Properties:
  • req.app: Reference to the Express app instance
  • req.baseUrl: The URL path on which a router instance was mounted
  • req.body: Parsed request body (requires body-parsing middleware)
  • req.cookies: Parsed cookies (requires cookie-parser middleware)
  • req.hostname: Host name derived from the Host HTTP header
  • req.ip: Remote IP address
  • req.method: HTTP method (GET, POST, etc.)
  • req.originalUrl: Original request URL
  • req.params: Object containing properties mapped to named route parameters
  • req.path: Path part of the request URL
  • req.protocol: Request protocol (http or https)
  • req.query: Object containing properties parsed from the query string
  • req.route: Current route information
  • req.secure: Boolean indicating if the connection is secure (HTTPS)
  • req.signedCookies: Signed cookies (requires cookie-parser middleware)
  • req.xhr: Boolean indicating if the request was an XMLHttpRequest
• Important Methods:
  • req.accepts(types): Checks if specified content types are acceptable
  • req.get(field): Returns the specified HTTP request header field
  • req.is(type): Returns true if the incoming request's "Content-Type" matches the MIME type

Response Object (res) Internals:

The response object is an enhanced version of Node.js's ServerResponse object, providing methods for sending various types of responses.

• Core Methods:
  • res.append(field, value): Appends specified value to HTTP response header field
  • res.attachment([filename]): Sets Content-Disposition header for file download
  • res.cookie(name, value, [options]): Sets cookie name to value
  • res.clearCookie(name, [options]): Clears the cookie specified by name
  • res.download(path, [filename], [callback]): Transfers file as an attachment
  • res.end([data], [encoding]): Ends the response process
  • res.format(object): Sends different responses based on Accept HTTP header
  • res.get(field): Returns the specified HTTP response header field
  • res.json([body]): Sends a JSON response
  • res.jsonp([body]): Sends a JSON response with JSONP support
  • res.links(links): Sets Link HTTP header field
  • res.location(path): Sets Location HTTP header
  • res.redirect([status,] path): Redirects to the specified path with optional status code
  • res.render(view, [locals], [callback]): Renders a view template
  • res.send([body]): Sends the HTTP response
  • res.sendFile(path, [options], [callback]): Sends a file as an octet stream
  • res.sendStatus(statusCode): Sets response status code and sends its string representation
  • res.set(field, [value]): Sets response's HTTP header field
  • res.status(code): Sets HTTP status code
  • res.type(type): Sets Content-Type HTTP header
  • res.vary(field): Adds field to Vary response header

const express = require('express');
const app = express();

// Middleware to parse JSON bodies
app.use(express.json());

app.post('/api/users/:id', (req, res) => {
  // Access route parameters
  const userId = req.params.id;
  
  // Access query string parameters
  const format = req.query.format || 'json';
  
  // Access request body
  const userData = req.body;
  
  // Check request headers
  const userAgent = req.get('User-Agent');
  
  // Check content type
  if (!req.is('application/json')) {
    return res.status(415).json({ error: 'Content type must be application/json' });
  }
  
  // Conditional response based on Accept header
  res.format({
    'application/json': function() {
      // Set custom headers
      res.set('X-API-Version', '1.0');
      
      // Set status and send JSON response
      res.status(200).json({
        id: userId,
        ...userData,
        _metadata: {
          userAgent,
          format
        }
      });
    },
    'text/html': function() {
      res.send(`
User ${userId} updated
`);
    },
    'default': function() {
      res.status(406).send('Not Acceptable');
    }
  });
});

// Error handling middleware
app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(500).json({ error: 'Something went wrong!' });
});

app.listen(3000);
        

Handling query parameters and request bodies in Express.js involves understanding both the automatic parsing features of Express and the middleware ecosystem that enhances this functionality.

Query Parameter Handling - Technical Details:

Query parameters are automatically parsed by Express using the Node.js built-in url module and made available via req.query.

• URL Parsing Mechanics:
  • Express uses the Node.js querystring module internally
  • The query string parser converts ?key=value&key2=value2 into a JavaScript object
  • Arrays can be represented as ?items=1&items=2 which becomes { items: ['1', '2'] }
  • Nested objects use bracket notation: ?user[name]=john&user[age]=25 becomes { user: { name: 'john', age: '25' } }
• Performance Considerations:
  • Query parsing happens on every request that contains a query string
  • For high-performance APIs, consider using route parameters (/users/:id) where appropriate instead of query parameters
  • Query parameter parsing can be customized using the query parser application setting

// Custom query string parser
app.set('query parser', (queryString) => {
  // Custom parsing logic
  const customParsed = someCustomParser(queryString);
  return customParsed;
});

// Using query validation with express-validator
const { query, validationResult } = require('express-validator');

app.get('/search', [
  // Validate and sanitize query parameters
  query('name').isString().trim().escape(),
  query('age').optional().isInt({ min: 1, max: 120 }).toInt(),
  query('sort').optional().isIn(['asc', 'desc']).withMessage('Sort must be asc or desc')
], (req, res) => {
  // Check for validation errors
  const errors = validationResult(req);
  if (!errors.isEmpty()) {
    return res.status(400).json({ errors: errors.array() });
  }
  
  // Safe to use the validated and transformed query params
  const { name, age, sort } = req.query;
  
  // Pagination example with defaults
  const page = parseInt(req.query.page || '1', 10);
  const limit = parseInt(req.query.limit || '10', 10);
  const offset = (page - 1) * limit;
  
  // Use parameters for database query or other operations
  res.json({
    parameters: { name, age, sort },
    pagination: { page, limit, offset }
  });
});
        

Request Body Handling - Technical Deep Dive:

Express requires middleware to parse request bodies because, unlike query strings, the Node.js HTTP module doesn't automatically parse request body data.

• Body-Parsing Middleware Internals:
  • express.json(): Creates middleware that parses JSON using body-parser internally
  • express.urlencoded(): Creates middleware that parses URL-encoded data
  • The extended: true option in urlencoded uses the qs library (instead of querystring) to support rich objects and arrays
  • Both middleware types intercept requests, read the entire request stream, parse it, and then make it available as req.body
• Content-Type Handling:
  • express.json() only parses requests with Content-Type: application/json
  • express.urlencoded() only parses requests with Content-Type: application/x-www-form-urlencoded
  • For multipart/form-data (file uploads), use specialized middleware like multer
• Configuration Options:
  • limit: Controls the maximum request body size (default is '100kb')
  • inflate: Controls handling of compressed bodies (default is true)
  • strict: For JSON parsing, only accept arrays and objects (default is true)
  • type: Custom type for the middleware to match against
  • verify: Function to verify the body before parsing
• Security Considerations:
  • Always set appropriate size limits to prevent DoS attacks
  • Consider implementing rate limiting for endpoints that accept large request bodies
  • Use validation middleware to ensure request data meets expected formats

const express = require('express');
const multer = require('multer');
const { body, validationResult } = require('express-validator');
const rateLimit = require('express-rate-limit');

const app = express();

// JSON body parser with configuration
app.use(express.json({
  limit: '1mb',
  strict: true,
  verify: (req, res, buf, encoding) => {
    // Optional verification function
    // Example: store raw body for signature verification
    if (req.headers['x-signature']) {
      req.rawBody = buf;
    }
  }
}));

// URL-encoded parser with configuration
app.use(express.urlencoded({
  extended: true,
  limit: '1mb'
}));

// File upload handling with multer
const upload = multer({
  storage: multer.diskStorage({
    destination: (req, file, cb) => {
      cb(null, './uploads');
    },
    filename: (req, file, cb) => {
      cb(null, Date.now() + '-' + file.originalname);
    }
  }),
  limits: {
    fileSize: 5 * 1024 * 1024 // 5MB limit
  },
  fileFilter: (req, file, cb) => {
    // Check file types
    if (file.mimetype.startsWith('image/')) {
      cb(null, true);
    } else {
      cb(new Error('Only image files are allowed'));
    }
  }
});

// Rate limiting for API endpoints
const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100 // 100 requests per windowMs
});

// Example route with JSON body handling
app.post('/api/users', apiLimiter, [
  // Validation middleware
  body('email').isEmail().normalizeEmail(),
  body('password').isLength({ min: 8 }).withMessage('Password must be at least 8 characters'),
  body('age').optional().isInt({ min: 18 }).withMessage('Must be at least 18 years old')
], (req, res) => {
  // Check for validation errors
  const errors = validationResult(req);
  if (!errors.isEmpty()) {
    return res.status(400).json({ errors: errors.array() });
  }
  
  const userData = req.body;
  // Process user data...
  res.status(201).json({ message: 'User created successfully' });
});

// Example route with file upload + form data
app.post('/api/profiles', upload.single('avatar'), [
  body('name').notEmpty().trim(),
  body('bio').optional().trim()
], (req, res) => {
  // req.file contains file info
  // req.body contains text fields
  
  const errors = validationResult(req);
  if (!errors.isEmpty()) {
    return res.status(400).json({ errors: errors.array() });
  }
  
  res.json({
    profile: req.body,
    avatar: req.file ? req.file.path : null
  });
});

// Error handler for body-parser errors
app.use((err, req, res, next) => {
  if (err instanceof SyntaxError && err.status === 400 && 'body' in err) {
    // Handle JSON parse error
    return res.status(400).json({ error: 'Invalid JSON' });
  }
  if (err.type === 'entity.too.large') {
    // Handle payload too large
    return res.status(413).json({ error: 'Payload too large' });
  }
  next(err);
});

app.listen(3000);
        

Error handling in Express.js requires a comprehensive strategy that addresses both synchronous and asynchronous errors, centralizes error processing, and provides appropriate responses based on error types.

Comprehensive Error Handling Architecture:

class ApplicationError extends Error {
  constructor(message, statusCode, errorCode) {
    super(message);
    this.name = this.constructor.name;
    this.statusCode = statusCode || 500;
    this.errorCode = errorCode || 'INTERNAL_ERROR';
    Error.captureStackTrace(this, this.constructor);
  }
}

class ResourceNotFoundError extends ApplicationError {
  constructor(resource, id) {
    super(`${resource} with id ${id} not found`, 404, 'RESOURCE_NOT_FOUND');
  }
}

class ValidationError extends ApplicationError {
  constructor(errors) {
    super('Validation failed', 400, 'VALIDATION_ERROR');
    this.errors = errors;
  }
}
        

// Higher-order function to wrap async route handlers
const asyncHandler = (fn) => (req, res, next) => {
  Promise.resolve(fn(req, res, next)).catch(next);
};

// Usage
app.get('/products/:id', asyncHandler(async (req, res) => {
  const product = await ProductService.findById(req.params.id);
  if (!product) {
    throw new ResourceNotFoundError('Product', req.params.id);
  }
  res.json(product);
}));
        

// 404 handler for undefined routes
app.use((req, res, next) => {
  next(new ResourceNotFoundError('Route', req.originalUrl));
});

// Centralized error handler
app.use((err, req, res, next) => {
  // Log error details for server-side diagnosis
  console.error(``Error [${req.method} ${req.url}]:`, {
    message: err.message,
    stack: err.stack,
    timestamp: new Date().toISOString(),
    requestId: req.id // Assuming request ID middleware
  });
  
  // Determine if error is trusted (known) or untrusted
  const isTrustedError = err instanceof ApplicationError;
  
  // Prepare response
  const response = {
    status: 'error',
    message: isTrustedError ? err.message : 'An unexpected error occurred',
    errorCode: err.errorCode || 'UNKNOWN_ERROR',
    requestId: req.id
  };
  
  // Add validation errors if present
  if (err instanceof ValidationError && err.errors) {
    response.details = err.errors;
  }
  
  // Hide stack trace in production
  if (process.env.NODE_ENV !== 'production' && err.stack) {
    response.stack = err.stack.split('\n');
  }
  
  // Send response
  res.status(err.statusCode || 500).json(response);
});
        

Advanced Error Handling Patterns:

• Domain-specific errors: Create error hierarchies for different application domains
• Error monitoring integration: Connect with services like Sentry, New Relic, or Datadog
• Error correlation: Use request IDs to trace errors across microservices
• Circuit breakers: Implement circuit breakers for external service failures
• Graceful degradation: Provide fallback behavior when services fail

Error-handling middleware in Express.js follows a specific execution pattern within the middleware pipeline and provides granular control over error processing through a cascading architecture. It leverages the signature difference (four parameters instead of three) as a convention for Express to identify error handlers.

Error Middleware Execution Flow:

When next(err) is called with an argument in any middleware or route handler:

1. Express skips any remaining non-error handling middleware and routes
2. It proceeds directly to the first error-handling middleware (functions with 4 parameters)
3. Error handlers can be chained by calling next(err) from within an error handler
4. If no error handler is found, Express falls back to its default error handler

// Application middleware and route definitions here...

// 404 Handler - This handles routes that weren't matched
app.use((req, res, next) => {
  const err = new Error('Not Found');
  err.status = 404;
  next(err); // Forward to error handler
});

// Client Error Handler (4xx)
app.use((err, req, res, next) => {
  if (err.status >= 400 && err.status < 500) {
    return res.status(err.status).json({
      error: {
        message: err.message,
        status: err.status,
        code: err.code || 'CLIENT_ERROR'
      }
    });
  }
  next(err); // Pass to next error handler if not a client error
});

// Validation Error Handler
app.use((err, req, res, next) => {
  if (err.name === 'ValidationError') {
    return res.status(400).json({
      error: {
        message: 'Validation Failed',
        details: err.details || err.message,
        code: 'VALIDATION_ERROR'
      }
    });
  }
  next(err);
});

// Database Error Handler
app.use((err, req, res, next) => {
  if (err.name === 'SequelizeError' || /mongodb/i.test(err.name)) {
    console.error('Database Error:', err);
    
    // Don't expose db error details in production
    return res.status(500).json({
      error: {
        message: process.env.NODE_ENV === 'production' 
          ? 'Database operation failed' 
          : err.message,
        code: 'DB_ERROR'
      }
    });
  }
  next(err);
});

// Fallback/Generic Error Handler
app.use((err, req, res, next) => {
  const statusCode = err.status || 500;
  
  // Log detailed error information for server errors
  if (statusCode >= 500) {
    console.error('Server Error:', {
      message: err.message,
      stack: err.stack,
      time: new Date().toISOString(),
      requestId: req.id,
      url: req.originalUrl,
      method: req.method,
      ip: req.ip
    });
  }
  
  res.status(statusCode).json({
    error: {
      message: statusCode >= 500 && process.env.NODE_ENV === 'production'
        ? 'Internal Server Error'
        : err.message,
      code: err.code || 'SERVER_ERROR',
      requestId: req.id
    }
  });
});
        

Advanced Implementation Techniques:

// Error handler factory that provides context
const errorHandler = (context) => (err, req, res, next) => {
  console.error(`Error in ${context}:`, err);
  
  // Attach context to error for downstream handlers
  err.contexts = [...(err.contexts || []), context];
  
  next(err);
};

// Usage in different parts of the application
app.use('/api/users', errorHandler('users-api'), usersRouter);
app.use('/api/products', errorHandler('products-api'), productsRouter);

// Final error handler can use the context
app.use((err, req, res, next) => {
  res.status(500).json({
    error: err.message,
    contexts: err.contexts // Shows where the error propagated through
  });
});
        

// Error handler with content negotiation
app.use((err, req, res, next) => {
  const statusCode = err.statusCode || 500;
  
  // Format error response based on requested content type
  res.format({
    // HTML response
    'text/html': () => {
      res.status(statusCode).render('error', {
        message: err.message,
        error: process.env.NODE_ENV === 'development' ? err : {},
        stack: process.env.NODE_ENV === 'development' ? err.stack : '
      });
    },
    
    // JSON response
    'application/json': () => {
      res.status(statusCode).json({
        error: {
          message: err.message,
          stack: process.env.NODE_ENV === 'development' ? err.stack : undefined
        }
      });
    },
    
    // Plain text response
    'text/plain': () => {
      res.status(statusCode).send(
        `Error: ${err.message}\n` +
        (process.env.NODE_ENV === 'development' ? err.stack : ')
      );
    },
    
    // Default response
    default: () => {
      res.status(406).send('Not Acceptable');
    }
  });
});
        

Express Router provides a modular, mountable route handler system that enables structured organization of routes and middleware in Express applications. This approach facilitates cleaner architecture and better separation of concerns.

Router Implementation Architecture

Express Router leverages Express's middleware architecture while providing isolation and namespace capabilities for route definitions. It implements the middleware pattern and creates a middleware stack specific to its routes.

Advanced Usage Patterns:

// productRoutes.js
const express = require('express');
const router = express.Router();

// Router-specific middleware - only applies to this router
router.use((req, res, next) => {
  req.resourceType = 'product';
  console.log('Product route accessed at', Date.now());
  next();
});

// Authentication middleware specific to product routes
router.use(productAuthMiddleware);

router.get('/', listProducts);
router.post('/', createProduct);
router.get('/:id', getProduct);
router.put('/:id', updateProduct);
router.delete('/:id', deleteProduct);

module.exports = router;
        

Router Parameter Pre-processing

Router instances can pre-process URL parameters before the route handlers execute:

router.param('productId', (req, res, next, productId) => {
  // Validate and convert the productId parameter
  const validatedId = parseInt(productId, 10);
  
  if (isNaN(validatedId)) {
    return res.status(400).json({ error: 'Invalid product ID format' });
  }
  
  // Fetch the product from database
  Product.findById(validatedId)
    .then(product => {
      if (!product) {
        return res.status(404).json({ error: 'Product not found' });
      }
      // Attach product to request object for use in route handlers
      req.product = product;
      next();
    })
    .catch(err => next(err));
});

// Now any route using :productId parameter will have req.product available
router.get('/:productId', (req, res) => {
  // req.product is already populated by the param middleware
  res.json(req.product);
});
    

Router Composition and Nesting

Routers can be nested within other routers to create hierarchical route structures:

// adminRoutes.js
const express = require('express');
const adminRouter = express.Router();
const productRouter = require('./productRoutes');
const userRouter = require('./userRoutes');

// Admin-specific middleware
adminRouter.use(adminAuthMiddleware);

// Mount other routers
adminRouter.use('/products', productRouter);
adminRouter.use('/users', userRouter);

// Admin-specific routes
adminRouter.get('/dashboard', showDashboard);
adminRouter.get('/settings', showSettings);

module.exports = adminRouter;

// In main app.js
app.use('/admin', adminRouter);
    

Performance Considerations

Each Router instance creates a middleware stack, which has memory implications. The routing system also performs pattern matching for each request. For highly performance-critical applications with many routes, consider:

• Using a router factory pattern to reduce memory consumption
• Organizing routes to minimize deep nesting that requires multiple pattern matches
• Using path-to-regexp caching for frequently accessed routes

app.use('/api/v1', v1Router);
app.use('/api/v2', v2Router);
        

Error Handling with Routers

Router instances can have their own error handlers, which will capture errors thrown within their middleware stack:

// Route-specific error handler
router.use((err, req, res, next) => {
  if (err.type === 'ProductValidationError') {
    return res.status(400).json({
      error: 'Product validation failed',
      details: err.details
    });
  }
  // Pass to parent error handler
  next(err);
});
    

Route modularity is a fundamental architectural pattern in Express.js applications that promotes separation of concerns, maintainability, and scalability. It involves decomposing route definitions into logical, cohesive modules that align with application domains and responsibilities.

Architectural Principles for Route Modularity

• Single Responsibility Principle: Each route module should focus on a specific domain or resource
• Encapsulation: Implementation details should be hidden within the module
• Interface Segregation: Route definitions should expose only what's necessary
• Dependency Inversion: Route handlers should depend on abstractions rather than implementations

Advanced Implementation Patterns

// controllers/userController.js
exports.getAllUsers = async (req, res, next) => {
  try {
    const users = await UserService.findAll();
    res.status(200).json({ success: true, data: users });
  } catch (err) {
    next(err);
  }
};

exports.getUserById = async (req, res, next) => {
  try {
    const user = await UserService.findById(req.params.id);
    if (!user) {
      return res.status(404).json({ success: false, error: 'User not found' });
    }
    res.status(200).json({ success: true, data: user });
  } catch (err) {
    next(err);
  }
};

// routes/userRoutes.js
const express = require('express');
const router = express.Router();
const userController = require('../controllers/userController');
const { authenticate, authorize } = require('../middleware/auth');

router.get('/', authenticate, userController.getAllUsers);
router.get('/:id', authenticate, userController.getUserById);

module.exports = router;
        

// utils/routeFactory.js
const express = require('express');

module.exports = function createResourceRouter(controller, middleware = {}) {
  const router = express.Router();
  const { 
    list = [], 
    get = [], 
    create = [], 
    update = [], 
    delete: deleteMiddleware = [] 
  } = middleware;
  
  // Define standard RESTful routes with injected middleware
  router.get('/', [...list], controller.list);
  router.post('/', [...create], controller.create);
  router.get('/:id', [...get], controller.get);
  router.put('/:id', [...update], controller.update);
  router.delete('/:id', [...deleteMiddleware], controller.delete);
  
  return router;
};

// routes/index.js
const userController = require('../controllers/userController');
const createResourceRouter = require('../utils/routeFactory');
const { authenticate, isAdmin } = require('../middleware/auth');

// Create a router with standard CRUD routes + custom middleware
const userRouter = createResourceRouter(userController, {
  list: [authenticate],
  get: [authenticate],
  create: [authenticate, isAdmin],
  update: [authenticate, isAdmin],
  delete: [authenticate, isAdmin]
});

module.exports = app => {
  app.use('/api/users', userRouter);
};
        

// Project structure:
// src/
//   /features
//     /users
//       /models
//         User.js
//       /controllers
//         userController.js
//       /services
//         userService.js
//       /routes
//         index.js
//     /products
//       /models
//       /controllers
//       /services
//       /routes
//   /middleware
//   /config
//   /utils
//   app.js

// src/features/users/routes/index.js
const express = require('express');
const router = express.Router();
const userController = require('../controllers/userController');

router.get('/', userController.getAllUsers);
router.post('/', userController.createUser);
// other routes...

module.exports = router;

// src/app.js
const express = require('express');
const app = express();

// Import feature routes
const userRoutes = require('./features/users/routes');
const productRoutes = require('./features/products/routes');

// Mount feature routes
app.use('/api/users', userRoutes);
app.use('/api/products', productRoutes);
        

Advanced Route Registration Patterns

For large applications, consider using dynamic route registration:

// routes/index.js
const fs = require('fs');
const path = require('path');
const express = require('express');

module.exports = function(app) {
  // Auto-discover and register all route modules
  fs.readdirSync(__dirname)
    .filter(file => file !== 'index.js' && file.endsWith('.js'))
    .forEach(file => {
      const routeName = file.split('.')[0];
      const route = require(path.join(__dirname, file));
      app.use(`/api/${routeName}`, route);
      console.log(`Registered route: /api/${routeName}`);
    });
    
  // Register nested route directories
  fs.readdirSync(__dirname)
    .filter(file => fs.statSync(path.join(__dirname, file)).isDirectory())
    .forEach(dir => {
      if (fs.existsSync(path.join(__dirname, dir, 'index.js'))) {
        const route = require(path.join(__dirname, dir, 'index.js'));
        app.use(`/api/${dir}`, route);
        console.log(`Registered route directory: /api/${dir}`);
      }
    });
};
    

Versioning with Route Modularity

Implement API versioning while maintaining modularity:

// routes/v1/users.js
const express = require('express');
const router = express.Router();
const userControllerV1 = require('../../controllers/v1/userController');

router.get('/', userControllerV1.getAllUsers);
// v1 specific routes...

module.exports = router;

// routes/v2/users.js
const express = require('express');
const router = express.Router();
const userControllerV2 = require('../../controllers/v2/userController');

router.get('/', userControllerV2.getAllUsers);
// v2 specific routes with enhanced functionality...

module.exports = router;

// app.js
app.use('/api/v1/users', require('./routes/v1/users'));
app.use('/api/v2/users', require('./routes/v2/users'));
    

// routes/userRoutes.js
module.exports = function(userService, authService, config) {
  const router = express.Router();
  
  router.get('/', async (req, res, next) => {
    try {
      const users = await userService.findAll();
      res.status(200).json(users);
    } catch (err) {
      next(err);
    }
  });
  
  // More routes...
  
  return router;
};

// app.js
const userService = require('./services/userService');
const authService = require('./services/authService');
const config = require('./config');

// Inject dependencies when mounting routes
app.use('/api/users', require('./routes/userRoutes')(userService, authService, config));
        

Performance Considerations

When implementing modular routes in production applications:

• Be mindful of the middleware stack depth as each module may add layers
• Consider lazy-loading route modules for large applications
• Implement proper error boundary handling within each route module
• Use route-specific middleware only when necessary to avoid unnecessary processing

Integrating template engines with Express.js involves configuring the view engine, optimizing performance, and understanding the underlying compilation mechanics.

Template Engine Integration Architecture:

Express uses a modular system that allows plugging in different template engines through a standardized interface. The integration process follows these steps:

1. Installation and module resolution: Express uses the node module resolution system to find the template engine
2. Engine registration: Using app.engine() for custom extensions or consolidation
3. Configuration: Setting view directory, engine, and caching options
4. Compilation strategy: Template precompilation vs. runtime compilation

const express = require('express');
const app = express();
const path = require('path');

// Custom engine registration for non-standard extensions
app.engine('pug', require('pug').__express);

// Advanced configuration
app.set('views', path.join(__dirname, 'views'));
app.set('view engine', 'pug');
app.set('view cache', process.env.NODE_ENV === 'production'); // Enable caching in production
app.locals.basedir = path.join(__dirname, 'views'); // For includes with absolute paths

// Handling errors in templates
app.use((err, req, res, next) => {
  if (err.view) {
    console.error('Template rendering error:', err);
    return res.status(500).send('Template error');
  }
  next(err);
});

// With Express 4.x, you can use multiple view engines with different extensions
app.set('view engine', 'pug'); // Default engine
app.engine('ejs', require('ejs').__express); // Also support EJS
        

Engine-Specific Implementation Details:

Performance Considerations:

• Template Precompilation: For production, precompile templates to JavaScript
• Caching Strategy: Enable view caching in production (app.set('view cache', true))
• Streaming Rendering: Some engines support streaming to reduce TTFB (Time To First Byte)
• Partial Rendering: Optimize by rendering only changed parts of templates

// Custom engine implementation example
const fs = require('fs');
const pug = require('pug');

// Create a custom rendering engine with caching
const pugCache = {};

app.engine('pug', (filePath, options, callback) => {
  // Check cache first
  if (pugCache[filePath] && process.env.NODE_ENV === 'production') {
    return callback(null, pugCache[filePath](options));
  }
  
  try {
    // Compile template with production-optimized settings
    const compiled = pug.compileFile(filePath, {
      cache: true,
      compileDebug: process.env.NODE_ENV !== 'production',
      debug: false
    });
    
    // Cache for future use
    pugCache[filePath] = compiled;
    
    // Render and return the output
    const output = compiled(options);
    callback(null, output);
  } catch (err) {
    callback(err);
  }
});
        

Passing data to templates in Express.js involves several architectural considerations and performance optimizations that go beyond the basic res.render() functionality.

Data Passing Architectures:

1. Direct Template Rendering

The simplest approach is passing data directly to templates via res.render(), but there are several advanced patterns:

// Standard approach with async data fetching
app.get('/dashboard', async (req, res) => {
  try {
    const [user, posts, analytics] = await Promise.all([
      userService.getUser(req.session.userId),
      postService.getUserPosts(req.session.userId),
      analyticsService.getUserMetrics(req.session.userId)
    ]);
    
    res.render('dashboard', {
      user,
      posts,
      analytics,
      helpers: templateHelpers, // Reusable helper functions
      _csrf: req.csrfToken() // Security tokens
    });
  } catch (err) {
    next(err);
  }
});
        

2. Middleware for Common Data

Middleware can automatically inject data into all templates without repetition:

// Global data middleware
app.use((req, res, next) => {
  // res.locals is available to all templates
  res.locals.user = req.user;
  res.locals.siteConfig = siteConfig;
  res.locals.currentPath = req.path;
  res.locals.flash = req.flash(); // For flash messages
  res.locals.csrfToken = req.csrfToken();
  res.locals.toJSON = function(obj) {
    return JSON.stringify(obj);
  };
  next();
});

// Later in a route, you only need to pass route-specific data
app.get('/dashboard', async (req, res) => {
  const dashboardData = await dashboardService.getData(req.user.id);
  res.render('dashboard', dashboardData);
});
        

3. View Model Pattern

For complex applications, separating view models from business logic improves maintainability:

// View model builder pattern
class ProfileViewModel {
  constructor(user, activity, permissions) {
    this.user = user;
    this.activity = activity;
    this.permissions = permissions;
  }
  
  prepare() {
    return {
      displayName: this.user.fullName || this.user.username,
      avatarUrl: this.getAvatarUrl(),
      activityStats: this.summarizeActivity(),
      canEditProfile: this.permissions.includes('EDIT_PROFILE'),
      lastLogin: this.formatLastLogin(),
      // Additional computed properties
    };
  }
  
  getAvatarUrl() {
    return this.user.avatar || `/default-avatars/${this.user.id % 5}.jpg`;
  }
  
  summarizeActivity() {
    // Complex logic to transform activity data
  }
  
  formatLastLogin() {
    // Format date logic
  }
}

// Usage in controller
app.get('/profile/:id', async (req, res) => {
  try {
    const [user, activity, permissions] = await Promise.all([
      userService.findById(req.params.id),
      activityService.getUserActivity(req.params.id),
      permissionService.getPermissionsFor(req.user.id, req.params.id)
    ]);
    
    const viewModel = new ProfileViewModel(user, activity, permissions);
    res.render('profile', viewModel.prepare());
  } catch (err) {
    next(err);
  }
});
        

Advanced Template Data Techniques:

1. Context-Specific Serialization

Different views may need different representations of the same data:

class User {
  constructor(data) {
    this.id = data.id;
    this.username = data.username;
    this.email = data.email;
    this.role = data.role;
    this.createdAt = new Date(data.created_at);
    this.profile = data.profile;
  }
  
  // Different serialization contexts
  toProfileView() {
    return {
      username: this.username,
      displayName: this.profile.displayName,
      bio: this.profile.bio,
      joinDate: this.createdAt.toLocaleDateString(),
      isAdmin: this.role === 'admin'
    };
  }
  
  toAdminView() {
    return {
      id: this.id,
      username: this.username,
      email: this.email,
      role: this.role,
      createdAt: this.createdAt,
      lastLogin: this.lastLogin
    };
  }
  
  toJSON() {
    // Default JSON representation
    return {
      username: this.username,
      role: this.role
    };
  }
}

// Usage
app.get('/profile', (req, res) => {
  const user = new User(userData);
  res.render('profile', { user: user.toProfileView() });
});

app.get('/admin/users', (req, res) => {
  const users = userDataArray.map(data => new User(data).toAdminView());
  res.render('admin/users', { users });
});
        

2. Template Data Pagination and Streaming

For large datasets, implement pagination or streaming:

// Paginated data with metadata
app.get('/posts', async (req, res) => {
  const page = parseInt(req.query.page) || 1;
  const limit = parseInt(req.query.limit) || 10;
  
  const { posts, total } = await postService.getPaginated(page, limit);
  
  res.render('posts', {
    posts,
    pagination: {
      current: page,
      total: Math.ceil(total / limit),
      hasNext: page * limit < total,
      hasPrev: page > 1,
      prevPage: page - 1,
      nextPage: page + 1,
      pages: Array.from({ length: Math.min(5, Math.ceil(total / limit)) }, 
             (_, i) => page + i - Math.min(page - 1, 2))
    }
  });
});

// Streaming large data sets (with supported template engines)
app.get('/large-report', (req, res) => {
  const stream = reportService.getReportStream();
  res.type('html');
  
  // Header template
  res.write('
Report
');
  
  stream.on('data', (chunk) => {
    // Process each row
    const row = processRow(chunk);
    res.write(``);
  });
  
  stream.on('end', () => {
    // Footer template
    res.write('
${row.field1}
${row.field2}
');
    res.end();
  });
});
        

3. Shared Template Context

Creating shared contexts for consistent template rendering:

// Template context factory
const createTemplateContext = (req, baseContext = {}) => {
  return {
    // Common data
    user: req.user,
    path: req.path,
    query: req.query,
    isAuthenticated: !!req.user,
    csrf: req.csrfToken(),
    
    // Common helper functions
    formatDate: (date, format = 'short') => {
      // Date formatting logic
    },
    truncate: (text, length = 100) => {
      return text.length > length ? text.substring(0, length) + '...' : text;
    },
    
    // Merge with page-specific context
    ...baseContext
  };
};

// Usage in routes
app.get('/blog/:slug', async (req, res) => {
  const post = await blogService.getPostBySlug(req.params.slug);
  const relatedPosts = await blogService.getRelatedPosts(post.id);
  
  const context = createTemplateContext(req, {
    post,
    relatedPosts,
    meta: {
      title: post.title,
      description: post.excerpt,
      canonical: `https://example.com/blog/${post.slug}`
    }
  });
  
  res.render('blog/post', context);
});
        

Security Considerations:

• Context-Sensitive Escaping: Different parts of templates may require different escaping rules (HTML vs. JavaScript vs. CSS)
• Data Sanitization: Always sanitize user-generated content before passing to templates
• CSRF Protection: Include CSRF tokens in all forms
• Content Security Policy: Consider how data might affect CSP compliance

// Sanitize user input before passing to templates
const sanitizeInput = (input) => {
  if (typeof input === 'string') {
    return sanitizeHtml(input, {
      allowedTags: ['b', 'i', 'em', 'strong', 'a'],
      allowedAttributes: {
        'a': ['href']
      }
    });
  } else if (Array.isArray(input)) {
    return input.map(sanitizeInput);
  } else if (typeof input === 'object' && input !== null) {
    const sanitized = {};
    for (const [key, value] of Object.entries(input)) {
      sanitized[key] = sanitizeInput(value);
    }
    return sanitized;
  }
  return input;
};

app.get('/user-content', async (req, res) => {
  const content = await userContentService.get(req.params.id);
  res.render('content', { 
    content: sanitizeInput(content),
    contentJSON: JSON.stringify(content).replace(/