ssrargo2t Express 4x API Reference Black Lives Matter. Support the Equal Justice Initiative Express 4.x API express() Creates an Express application. The express() function is a top-level function exported by the express module, var express = require(express') var app = express() Methods express.json([options]) ‘This middleware is available in Express v4.16.0 onwards. This is a built-in middleware function in Express. It parses incoming requests with JSON payloads and is based on body-parser. Returns middleware that only parses JSON and only looks at requests where the Content-Type header matches the type option. This parser accepts any Unicode encoding of the body and supports automatic inflation of gzip and deflate encodings. ‘Anew body object containing the parsed data is populated on the request object after the middleware (i.e req. body), or an empty object ({}) if there was no body to parse, the Content-Type was not matched, or an error occurred. ‘As req. body's shape is based on user-controlled input, all properties and values in this object are untrusted and should be validated before trusting. For example, req. body. foo.toString() may fail in multiple ways, for example foo may not be there or may not be a string, and toString may not be a function and instead a string or other user-input, The following table describes the properties of the optional options object. Property Description Type Default inflate | Enables or disables handling deflated (compressed) bodies; when Boolean | true disabled, deflated bodies are rejected hitpssfexpressis.comfeni4vapihim! 116siror2024 Express 4x API Reference Property Description Type Default Limit Controls the maximum request body size. If this is anumber, then Mixed | “1@@kb" the value specifies the number of bytes; if itis a string, the value is passed to the bytes library for parsing. reviver | The reviver option is passed directly to ISON. parse as the second Function | nul argument. You can find more information on this argument in the MDN documentation about |SON.parse strict | Enables or disables only accepting arrays and objects; when disabled Boolean | true will accept anything 3SON. parse accepts. type This is used to determine what media type the middleware will Mixed | “applic parse. This option can be a string, array of strings, or a function. if ation/j not a function, type option is passed directly to the types library son” and this can be an extension name (like json), a mime type (like appl ication/json), or a mime type with a wildcard (like */* or */json). If a function, the type option is called as fn(req) and the request is parsed if it returns a truthy value. verify This option, if supplied, is called as verify(req, res, buf, encodi Function undefin ng), where buf is a Buffer of the raw request body and encoding is ed the encoding of the request. The parsing can be aborted by throwing an error, express.raw([options]) ‘This middleware is available in Express v4.17.0 onwards, This is a built-in middleware function in Express. It parses incoming request payloads into a Buffer and is based on body-parser. Returns middleware that parses all bodies as a Buffer and only looks at requests where the Content-Type header matches the type option. This parser accepts any Unicode encoding of the body and supports automatic inflation of gzip and deflate encodings. ‘Anew body Buffer containing the parsed data is populated on the request object after the middleware (Le. req. body), or an empty object ({}) if there was no body to parse, the Content-Type was not matched, or an error occurred. As req. body's shape is based on user-controlled input all properties and values in this object are untrusted and should be validated before trusting, For example, req. body.toString() may fail in multiple ways, for example stacking multiple parsers req. body may be from a different parser. Testing that req. body is a Buf Fer before calling buffer methods is recommended, The following table describes the properties of the optional options object. Property Description Type Default inflate | Enables or disables handling deflated (compressed) bodies; when Boolean true disabled, deflated bodies are rejected. hitpssfexpressis.comfeni4vapihim! 2185siror2024 Express 4x API Reference Property Description Type Default Limit Controls the maximum request body size. If this is anumber, then Mixed | “1@@kb" the value specifies the number of bytes; if its a string, the value is passed to the bytes library for parsing. type This is used to determine what media type the middleware will Mixed “applic parse. This option can be a string, array of strings, or a function. if ation/o not a function, type option is passed directly to the type-is library ctet-st and this can be an extension name (like bin), a mime type (like appli rean” cation/octet-strean), or a mime type with a wildcard (like */* or a pplication/*). If a function, the type option is called as fn(req) and the request is parsed if it returns a truthy value. verify This option, if supplied, is called as verify(req, res, buf, encodi Function undefin ng), where buf is a Buf fer of the raw request body and encoding is ed the encoding of the request. The parsing can be aborted by throwing an error, express.Router([options]) Creates a new router object. var router = express.Router([options}) The optional options parameter specifies the behavior of the router. Property Description Default Availability caseSens Enable case sensitivity, Disabled by default, itive treating "/Foo" and “ffoo" as the same. mergePar Preserve the req.params values from the false 45.0 ams parent router. If the parent and the child have conflicting param names, the child's value take precedence. strict Enable strict routing. Disabled by default, "/foo" and "foo!" are treated the same by the router. ‘ » You can add middleware and HTTP method routes (such as get, put, post, and so on) to router just like an application. For more information, see Router. express.static(root, [options]) This is a built-in middleware function in Express. It serves static files and is based on serve-static. hitpssexpressis.comfen4vapi.him! 2185syz0r2024 Express 4x API Reference NOTE: For best results, use a reverse proxy cache to improve performance of serving static assets. The root argument specifies the root directory from which to serve static assets. The function determines the file to serve by combining req.url with the provided root directory. When a file is not found, instead of sending a 404 response, it instead calls next() to move on to the next middleware, allowing for stacking and fall-backs. The following table describes the properties of the options object. See also the example below. Property Description Type Default dotfiles | Determines how dotfiles (files or directories that begin with a dot | String | “ignore” “are treated. See dotfiles below. etag Enable or disable etag generation Boolean true NOTE: express. static always sends weak ETags. extensio Sets file extension fallbacks: Ifa file is not found, search forfiles. | Mixed false ns with the specified extensions and serve the first one found, Example: ["html", ‘htm’ ] fallthro Let client errors fall-through as unhandled requests, otherwise | Boolean | true ugh forward a client error. See fallthrough below. immutabl | Enable or disable the immutable directive in the Cache-Control Boolean false e response header. If enabled, the maxAge option should also be specified to enable caching. The inmutable directive will prevent supported clients from making conditional requests during the life of the maxage option to check if the file has changed index | Sends the specified directory index file. Set to false to disable | Mixed —_ “index.htm! directory indexing. lastModi Set the Last-Modified header to the last modified date of the file Boolean true fied onthe OS maxAge _ Set the max-age property of the Cache-Control header in Number | 0 milliseconds or a string in ms format. redirect | Redirect to trailing "/” when the pathname is a directory. Boolean true setHeade | Function for setting HTTP headers to serve with the file Function rs See setHeaders below. For more information, see Serving static files in Express, and Using middleware - Built-in middleware. dotfiles Possible values for this option are: * “allow” - No special treatment for dotfiles. hitpssexpressis.comfen4vapihim! 4185sirorz024 Express 4 API Reference + ‘deny’ - Deny a request for a dotfle, respond with 483, then call next(). * “ignore”- Act as if the dottile does not exist, respond with 494, then call next() NOTE: With the default value, it will not ignore files in a directory that begins with a dot. fallthrough When this option is true, client errors such as a bad request or a request to a non-existent file will cause this middleware to simply call next() to invoke the next middleware in the stack, When false, these errors (even 4045), will invoke next (err) Set this option to true so you can map multiple physical directories to the sarne web address or for routes to fill in non-existent files, Use false if you have mounted this middleware at a path designed to be strictly a single file system directory, which allows for short-circuiting 404s for less overhead. This middleware will also reply to all methods. setHeaders For this option, specify a function to set custom response headers. Alterations to the headers must occur synchronously. ‘The signature of the function is: fn(res, path, stat) ‘Arguments: * res, the response object. * path, the file path that is being sent, * stat, the stat object of the file that is being sent. Example of express.static Here is an example of using the express. static middleware function with an elaborate options object: var options = { dotfiles: ‘ignore’, etag: false, extensions: ["htm’, "htwl"], index: false, maxhge: ‘1d', redirect: false, setHeaders: function (res, path, stat) ( res.set('x-timestamp', Date.now()) hitpssexpressis.comfen4vapihim! 5185searzo2t Express 4x API Reference app.use(express.static("public', options)) express.text([options]) ‘This middleware is available in Express v4.17.0 onwards This is a built-in middleware function in Express. It parses incoming request payloads into a string and is based on body-parser. Returns middleware that parses all bodies as a string and only looks at requests where the Content-Type header matches the type option. This parser accepts any Unicode encoding of the body and supports automatic inflation of gzip and deflate encodings. ‘Anew body string containing the parsed data is populated on the request object after the middleware (ie. req. body), or an empty object ({}) if there was no body to parse, the Content-Type was not matched, or an error occurred. As req. body's shape is based on user-controlled input, all properties and values in this object are untrusted and should be validated before trusting, For example, req. body.trim() ray fallin multiple ways, for example stacking multiple parsers req. body may be from a different parser, Testing that req. body isa string before calling string methods is recommended, The following table describes the properties of the optional options object. Property Description Type Default defaultC Specify the default character set for the text content if the charset is String | “ut f-8" harset | not specified in the Content-Type header of the request. inflate | Enables or disables handling deflated (compressed) bodies; when Boolean | true disabled, deflated bodies are rejected. Limit Controls the maximum request body size. Ifthis is anumber, then Mixed | “1@akb" the value specifies the number of bytes; if its a string, the value is passed to the bytes library for parsing. type This is used to determine what media type the middleware will Mixed | “text/p parse. This option can be a string, array of strings, or a function. if lain” not a function, type option is passed directly to the type-is library and this can be an extension name (like txt), a mime type (like text/ plain), or a mime type with a wildcard (like */* or text/*). Ifa function, the type option is called as fn(req) and the request is parsed if it returns a truthy value. verify This option, if supplied, is called as verify(req, res, buf, encodi Function undefin ng), where buf is a Buf fer of the raw request body and encoding is ed the encoding of the request. The parsing can be aborted by throwing an error, express.urlencoded([options]) hitpssexpressis.comfen4vapi.him! esssy20r2024 xpress 4 API Reference ‘This middleware is available in Express v4.16.0 onwards. This is a built-in middleware function in Express. It parses incoming requests with urlencoded payloads and is based on body-parser. Returns middleware that only parses urlencoded bodies and only looks at requests where the Content-Ty pe header matches the type option. This parser accepts only UTF-8 encoding of the body and supports automatic inflation of gzip and deflate encodings. ‘Anew body object containing the parsed data is populated on the request object after the middleware (i.e req. body), or an empty object ({}) if there was no body to parse, the Content-Type was not matched, or an error occurred. This object will contain key-value pairs, where the value can be a string or array (when e xtended is false), or any type (when extended is true). ‘As req. body's shape is based on user-controlled input, all properties and values in this object are untrusted and should be validated before trusting. For example, req. body. foo. toString() may fail in multiple ways, for example foo may not be there or may not be a string, and toString may not be a function and instead a string, or other user-input, The following table describes the properties of the optional options object. Property Description Type Default extended This option allows to choose between parsing the URL-encoded data Boolean | true with the querystring library (when false) or the qs library (when tr ue). The “extended” syntax allows for rich objects and arrays to be encoded into the URL-encoded format, allowing for a JSON-like experience with URL-encoded. For more information, please see the qs library. inflate | Enables or disables handling deflated (compressed) bodies; when Boolean true disabled, deflated bodies are rejected. Limit | Controls the maximum request body size. If this is anumber, then Mixed “"1@0kb" the value specifies the number of bytes; if itis a string, the value is passed to the bytes library for parsing, paramete This option controls the maximum number of parameters that are Number | 1000 rLinit allowed in the URL-encoded data. If a request contains more parameters than this value, an error will be raised. type This is used to determine what media type the middleware will Mixed | “applic parse. This option can be a string, array of strings, or a function. If ation/x Not a function, type option is passed directly to the type-is library “wie F0 and this can be an extension name (like urlencoded), a mime type rm-urle (like application/x-www-form-urlencoded), or a mime type with a coded" wildcard (like */x-www-form-urlencoded). If a function, the type option is called as fn(neq) and the request is parsed if it returns a truthy value, verify This option, if supplied, is called as verify(req, res, buf, encodi Function undefin ng), where but is a Buffer of the raw request body and encoding is ed the encoding of the request. The parsing can be aborted by throwing an error. hitpssexpressis.comfen4vapi.him! 7185saan bores AP Retence Application The app object conventionally denotes the Express application. Create it by calling the top-level express() function exported by the Express module: var express = require(‘express') var app = express() app-get('/", function (req, res) { res.send(‘hello world’) » app. 1isten(300@) The app object has methods for * Routing HTTP requests; see for example, app. METHOD and app.param. Configuring middleware; see app.route. * Rendering HTML views; see app.render. * Registering a template engine; see app.engine. It also has settings (properties) that affect how the application behaves; for more information, see Application settings. ‘The Express application object can be referred from the request object and the response object as req. app, and rres..app, respectively Properties app.locals ‘The app. locals object has properties that are local variables within the application. console. dir(app. locals.title) J) => "My Appt console.dir(app. locals .email) 11 => ‘[email protected]’ Once set, the value of app. locals properties persist throughout the life of the application, in contrast with res.locals properties that are valid only for the lifetime of the request. You can access local variables in templates rendered within the application. This is useful for providing helper functions to templates, as well as application-level data. Local variables are available in middleware via req. app. locals (see req.app) hitpssexpressis.comfen4vapi.him! aresssrargo2t Express 4x API Reference app.locals.title = ‘My App’ app. locals. strftime = require('strftime') app.locals.email = ‘[email protected]* app.mountpath ‘The app-mountpath property contains one or more path patterns on which a sub-app was mounted. ‘A sub-app Is an instance of express that may be used for handling the request to a route. var express = require('express') var app = express() // the main app var admin = express() // the sub app admin.get(‘/', function (req, res) { console. log(admin.mountpath) // /admin res.send('Adnin Homepage’) » app-use('/admin’, admin) // mount the sub app Itis similar to the baseUrl property of the req object, except req. baseUr returns the matched URL path, instead of the matched patterns, Ifa sub-app is mounted on multiple path patterns, app. mountpath returns the list of patterns itis mounted on, as shown in the following example. var admin = express() admin.get(‘/', function (req, res) { console.dir(admin.mountpath) // [ ‘/adm*n', '/manager* ] res.send( ‘Admin Homepage’) » var secret = express() secret.get("/', function (req, res) { console. log(secret.mountpath) // /secr*t res.send(‘Admin Secret’) » admin.use(’/secr*t', secret) // load the ‘secret’ router on '/secr#t’, on the ‘admin’ sub app hitpssexpressis.comfen4vapihim! 9185syear2021 Express 4x API Reference app.use(['/adm*n', ‘/manager'], admin) // load the ‘admin’ router on ‘/adm*n' and "ymanager', on the parent app Events app.on(‘mount’, callback(parent)) The mount event is fired on a sub-app, when it is mounted on a parent app. The parent app is passed to the callback function NOTE Sub-apps will + Not inherit the value of settings that have a default value. You must set the value in the sub-app. ‘Inherit the value of settings with no default value. For details, see Application settings. var admin = express() admin.on(‘mount', function (parent) ¢ console. log(‘Adnin Mounted" ) console.log(parent) // refers to the parent app » admin.get(‘/", function (req, res) { res.send(‘Admin Homepage’) » app.use('/adnin', admin) Methods app.all(path, callback [, callback ...]) This method is like the standard app.METHOD() methods, except it matches all HTTP verbs. Arguments Argument Description Default path The path for which the middleware function is invoked; can be any of: 1" (root path) + Astring representing a path. + Apath pattern, ‘+ Aregular expression pattern to match paths. * An array of combinations of any of the above. hitpssexpressis.comfen4vapi.him! 10185syeor2021 Express 4x API Reference For examples, see Path examples. callback Callback functions; can be: None ‘A middleware function. Aseries of middleware functions (separated by commas). An array of middleware functions. Acombination of all of the above. You can provide multiple callback functions that behave just like middleware, except that these callbacks can invoke next(‘route" ) to bypass the remaining route callback(s). You can use this mechanism to impose pre-conditions on a route, then pass control to subsequent routes if there is no reason to proceed with the current route. Since router and app implement the middleware interface, you can use them as you would any other middleware function. For examples, see Middleware callback function examples. Examples The following callback is executed for requests to /secret whether using GET, POST, PUT, DELETE, or any other HTTP request method: app.all("/secret’, function (req, res, next) { console.log(‘Accessing the secret section . next() // pass control to the next handler » The app.al1() method is useful for mapping “global” logic for specific path prefixes or arbitrary matches. For example, if you put the following at the top of all other route definitions, it requires that all routes from that point on require authentication, and automatically load a user. Keep in mind that these callbacks do not have to act as end-points: loadUser can perform a task, then call next() to continue matching subsequent routes. app.all('*', requireauthentication, loadUser) Or the equivalent: app.al1(‘*", requireauthentication) app.all(*', loaduser) Another example is white-listed “global” functionality. The example is similar to the ones above, but it only restricts paths that start with “/api": app.all('/api/*", requireAuthentication) app.delete(path, callback [, callback ...]) hitpssexpressis.comfen4vapi.him! 1085syz0r2024 Express 4x API Reference Routes HTTP DELETE requests to the specified path with the specified callback functions. For more information, see the routing guide. Arguments Argument Description Default path The path for which the middleware function is invoked; can be any of: 1" (root path) ‘+ Astring representing a path. ‘+ Apath pattern. ‘+ Aregular expression pattern to match paths. ‘+ Anarray of combinations of any of the above, For examples, see Path examples. callback Callback functions; can be: None ‘A middleware function. A series of middleware functions (separated by commas). An array of middleware functions. A combination of all of the above. You can provide multiple callback functions that behave just like middleware, except that these callbacks can invoke next(‘route') to bypass the remaining route callback(s). You can use this mechanism to impose pre-conditions on a route, then pass control to subsequent routes if there is no reason to proceed with the current route. Since router and app implement the middleware interface, you can use them as you would any other middleware function, For examples, see Middleware callback function examples. Example app-delete('/", function (req, res) { res.send('DELETE request to homepage’) » app.disable(name) Sets the Boolean setting name to false, where nane is one of the properties from the app settings table. Calling app.set(‘foo', false) for a Boolean property is the same as calling app. disable( oo" ) For example: app. disable('trust proxy’) app.get (‘trust proxy") // => false hitpssexpressis.comlen4vapihim! 12186ssrargo2t Express 4x API Reference app.disabled(name) Returns true if the Boolean setting nane is disabled (False), where nane is one of the properties from the app settings table app.disabled( ‘trust proxy’) u true app.enable('trust proxy") app.disabled(‘trust proxy') // => false app.enable(name) Sets the Boolean setting name to true, where name is one of the properties from the app settings table. Calling app.set('foo", true) for a Boolean property is the same as calling app.enable( foo"). app.enable('trust proxy") app.get('trust proxy’) // => true app.enabled(name) Returns true if the setting name is enabled (true), where nane is one of the properties from the app settings table. app.enabled( ‘trust proxy’) // => false app-enable("trust proxy") app.enabled('trust proxy’) W true app-engine(ext, callback) Registers the given template engine callback as ext. By default, Express will require() the engine based on the file extension. For example, if you try to render a “foo.pug' file, Express invokes the following internally, and caches the require() on subsequent calls to increase performance. app.engine('pug", require(‘pug').__express) Use this method for engines that do not provide .__express out of the box, or if you wish to “map” a different extension to the template engine hitpssexpressis.comfen4vapi.him! 19185sirorz024 Express 4x API Reference For example, to map the EJS template engine to “.htmI” files app.engine(‘html', require('ejs').renderFile) In this case, EJS provides a .renderFile() method with the same signature that Express expects: (path, options, callback), though note that it aliases this method as ejs.__express internally so if you're using “.ejs” extensions you don't need to do anything. Some template engines do not follow this convention. The consolidates library maps Node template engines to follow this convention, so they work seamlessly with Express. var engines = require(‘consolidate') app.engine(‘haml', engines.haml) app.engine(‘html’, engines.hogan) app.get(name) Returns the value of nane app setting, where nane is one of the strings in the app settings table. For example: app.get('title’) // => undefined app.set('title', ‘My Site’) app.get('title’) J] => "My Site" app.get(path, callback [, callback ...}) Routes HTTP GET requests to the specified path with the specified callback functions. Arguments Argument Description Default path ‘The path for which the middleware function is invoked; can be any of: 1 (root path) + Astring representing a path. * Apath pattern. ‘+ Aregular expression pattern to match paths. * Anarray of combinations of any of the above, For examples, see Path examples. callback Callback functions; can be: None ‘A middleware function. A series of middleware functions (separated by commas). ‘An array of middleware functions ‘A combination of all of the above, hitpssexpressis.comfen4vapi.him! 1410ssyrorz0et Express 4x API Reference You can provide multiple callback functions that behave just like middleware, except that these callbacks can invoke next(‘route") to bypass the remaining route callback(s). You can use this mechanism to impose pre-conditions on a route, then pass control to subsequent routes if there is no reason to proceed with the current route. Since router and app implement the middleware interface, you can use them as you would any other middleware function. For examples, see Middleware callback function examples. For more information, see the routing guide. Example app-get('/", function (req, res) { res.send('GET request to homepage") » app.listen(path, [callback]) Starts a UNIX socket and listens for connections on the given path. This method is identical to Node's hup.Server.listend) var express = require(‘express') var app = express() app. listen" /tmp/sock') app.listen([port[, host[, backlog]]][, callback]) Binds and listens for connections on the specified host and port. This method is identical to Node’s, http.Server.listend. IF port is omitted or is 0, the operating system will assign an arbitrary unused port, which is useful for cases like automated tasks (tests, etc.) var express = require(express') var app = express() app. Listen(3000) The app returned by express() is in fact a JavaScript Function, designed to be passed to Node’s HTTP servers as a callback to handle requests. This makes it easy to provide both HTTP and HTTPS versions of your app with the same code base, as the app does not inherit from these (its simply a callback): var express = require(‘express') var https = require('https') var http = require(‘http") var app = express() hitpssexpressis.comfen4vapihim! 16185syz0r2024 Express 4x API Reference http. createServer (app) . listen(80) https.createServer(options, app). listen(443) The app.1isten() method returns an http.Server object and (for HTTP) is a convenience method for the following: app.listen = function () { var server = http.createServer(this) return server.listen.apply(server, arguments) ? NOTE: All the forms of Node's http.Serverlisten() method are in fact actually supported. app.METHOD(path, callback [, callback ...]) Routes an HTTP request, where METHOD is the HTTP method of the request, such as GET, PUT, POST, and so on, in lowercase, Thus, the actual methods are app.get(), app. post(), app.put(), and so on, See Routing methods below for the complete list. Arguments Argument Description Default path The path for which the middleware function is invoked; can be any of: ' (root path) + Astring representing a path. * Apath pattern. ‘* Aregular expression pattern to match paths. + Anarray of combinations of any of the above. For examples, see Path examples. callback Callback functions; can be: None ‘+ Amiddleware function + Aseries of middleware functions (separated by commas). ‘+ An array of middleware functions. + Acombination of all of the above. You can provide multiple callback functions that behave just like middleware, except that these callbacks can invoke next(‘route" ) to bypass the remaining route callback(s). You can use this mechanism to impose pre-conditions on a route, then pass control to subsequent routes if there is no reason to proceed with the current route. Since router and app implement the middleware interface, you can use them as you would any other middleware function. For examples, see Middleware callback function examples. hitpssexpressis.comfen4vapi.him! 16185sreargo2t Express 4x API Reference Routing methods Express supports the following routing methods corresponding to the HTTP methods of the sane names: © checkout + mkcol + purge © copy + move © put * delete + m-search * report © get + notify * search * head * options * subscribe * lock * patch * trace © merge © post © unlock © mkactivity © unsubscribe The API documentation has explicit entries only for the most popular HTTP methods app.get(), app. post (), app-put(), and app. delete(). However, the other methods listed above work in exactly the same way. To route methods that translate to invalid JavaScript variable names, use the bracket notation. For example, app ‘m-search']("/", function ... The app.get() function is automatically called for the HTTP HEAD method in addition to the GET method if app-he ad() was not called for the path before app.get(). The method, app.a11(), is not derived from any HTTP method and loads middleware at the specified path for alf HTTP request methods. For more information, see app.all For more information on routing, see the routing guide. app.param([name], callback) ‘Add callback triggers to route parameters, where nane is the name of the parameter or an array of them, and callback is the callback function. The parameters of the callback function are the request object, the response object, the next middleware, the value of the parameter and the name of the parameter, in that order. If name is an array, the callback trigger is registered for each parameter declared in it, in the order in which they are declared. Furthermore, for each declared parameter except the last one, a call to next. inside the callback will call the callback for the next declared parameter. For the last parameter, a call to ne xt will call the next middleware in place for the route currently being processed, just like it would if name were just a string For example, when user is present in a route path, you may map user loading logic to automatically provide req. user to the route, or perform validations on the parameter input. app.param(‘user’, function (req, res, next, id) { // try to get the user details from the User model and attach it to the request object User.find(id, function (err, user) ( if (err) { next (err) hitpssexpressis.comfen4vapihim! ‘85syz0r2024 Express 4x API Reference } else if (user) { req.user = user next () } else ¢ next(new Error('failed to load user’)) > » » Param callback functions are local to the router on which they are defined. They are not inherited by mounted apps or routers. Hence, param callbacks defined on app will be triggered only by route parameters defined on app routes. All param callbacks will be called before any handler of any route in which the param occurs, and they will each be called only once in a request-response cycle, even if the parameter is matched in multiple routes, as shown in the following examples. app.param('id', function (req, res, next, id) ¢ console. log( CALLED ONLY ONCE") next() » app.get('/user/:id', function (req, res, next) { console. log(‘although this matches") next() » app.get('/user/:id', function (req, res) { console. log("and this matches too’) res.end() » On GET /user/42, the following is printed: CALLED ONLY ONCE although this matches and this matches too app.param(['id", ‘page'], function (req, res, next, value) { console. log( "CALLED ONLY ONCE with’, value) next() » app.get('/user/:id/:page’, function (req, res, next) { console. log( ‘although this matches") next () hitpssexpressis.comfen4vapi.him! e185syz0r2024 Express 4x API Reference » app.get('/user/:id/:page’, function (req, res) { console.log(*and this matches too’) res.end() » On GET /user/42/3, the following is printed: CALLED ONLY ONCE with 42 CALLED ONLY ONCE with 3 although this matches and this matches too The following section describes app.param(cal1back), which is deprecated as of v4.11.0. The behavior of the app.param(name, callback) method can be altered entirely by passing only a function to app. param(). This function is a custom implementation of how app.param(nane, callback) should behave - it accepts two parameters and must return a middleware. The first parameter of this function is the name of the URL parameter that should be captured, the second parameter can be any JavaScript object which might be used for returning the middleware implementation The middleware returned by the function decides the behavior of what happens when a URL parameter is captured. In this example, the app.param(name, callback) signature is modified to app.param(name, accessTd), Instead of accepting a name and a callback, app. param() will now accept a name and a number. var express = require(‘express') var app = express() // customizing the behavior of app.paran() app-paran(function (param, option) { return function (req, res, next, val) { if (val === option) ¢ next () } else ( next (‘route’) } } » // using the custonized app.paran() app-param("id', 1337) hitpssexpressis.comfen4vapi.him! 19185siroz024 Express 4 API Reference // route to trigger the capture app-get("/user/:id", function (req, res) { res.send('OK") » app.1isten(30@@, function () { console. log( Ready’) » In this example, the app.param(name, callback) signature remains the same, but instead of a middleware callback, a custom data type checking function has been defined to validate the data type of the user id. app.param(function (param, validator) { return function (req, res, next, val) { if (validator(val)) { next() } else ¢ next (‘route’) } 2 » app-param('id", function (candidate) return !isNaN(parseFloat(candidate)) && isFinite(candidate) » The.’ character can't be used to capture a character in your capturing regexp. For example you cantt use * /user =.4/" to capture “users-gami, use [\\s\\S] or [\\w\\W] instead (as in * /user-[\\s\\S]+/ Examples: J] captures '1-3_6' but not '543-azser-sder: router.get("/[0-9]+-[{\\w]]*", function (req, res, next) { next() }) // captures "1-26" and "543-az(ser*-sder* but not °S-a 5° router.get("/[2-5]+-[[\\5]]*", function (req, res, next) { next() }) // captures a1 (equivalent to '.*") router.get("[[\\s\\S]]*", function (neq, res, next) { next() }) app.path() Returns the canonical path of the app, a string, hitpssexpressis.comfen4vapi.him! 2016ssrargo2t Express 4x API Reference var app = express() var blog = express() var blogadmin = express() app-use('/blog’, blog) blog-use('/adnin’, blogadmin) console.dir(app.path()) // ** console.dir(blog.path()) // '/blog’ console.dir(blogAdnin.path()) // */blog/adnin* ‘The behavior of this method can become very complicated in complex cases of mounted apps: itis usually better to use req.baseUTrl to get the canonical path of the app. app.post(path, callback [, callback ...]) Routes HTTP POST requests to the specified path with the specified callback functions. For more information, see the routing guide. Arguments Argument Description Default path ‘The path for which the middleware function is invoked; can be any of: 1 (root path) Astring representing a path. A path pattern. A regular expression pattern to match paths. An array of combinations of any of the above. For examples, see Path examples. callback Callback functions; can be: None ‘+ Amiddleware function. ‘+ Aseries of middleware functions (separated by commas). ‘+ An array of middleware functions. ‘* Acombination of all of the above. You can provide multiple callback functions that behave just like middleware, except that these callbacks can invoke next(‘route" ) to bypass the remaining route callback(s). You can use this mechanism to impose pre-conditions on a route, then pass control to subsequent routes if there is no reason to proceed with the current route. Since router and app implement the middleware interface, you can use them as you would any other middleware function. For examples, see Middleware callback function examples. Example hitpssexpressis.comfen4vapi.him! 268ssrargo2t Express 4x API Reference app.post('/", function (req, res) { res.send('POST request to homepage’) » app.put(path, callback [, callback ...]) Routes HTTP PUT requests to the specified path with the specified callback functions. Arguments Argument Description Default path ‘The path for which the middleware function is invoked; can be any of: (root path) Astring representing a path. A path pattern. A regular expression pattern to match paths. An array of combinations of any of the above. For examples, see Path examples. callback | Callback functions; can be: None + Amiddleware function. * Aseries of middleware functions (separated by commas). * Anarray of middleware functions. * Acombination of all of the above. You can provide multiple callback functions that behave just like middleware, except that these callbacks can invoke next('route" ) to bypass the remaining route callback(s). You can use this mechanism to impose pre-conditions on a route, then pass control to subsequent routes if there is no reason to proceed with the current route. Since router and app implement the middleware interface, you can use them as you would any other middleware function. For examples, see Middleware callback function examples. Example app.put('/’, function (req, res) { res.send('PUT request to homepage’) » app.render(view, [locals], callback) Returns the rendered HTML of a view via the callback function. It accepts an optional parameter that is an object containing local variables for the view. Its like res.render(), except it cannot send the rendered hitpssexpressis.comfen4vapi.him! 22168ssrargo2t Express 4x API Reference view to the client on its own. Think of app.render() as a utility function for generating rendered view strings. Internally res.render() uses ap P.render() to render views, The local variable cache is reserved for enabling view cache. Set it to true, ifyou want to cache view during. development; view caching is enabled in production by default. app.render(‘enail', function (err, html) { u" » app.render(‘email', { name: ‘Tobi' }, function (err, html) Moves » app.route(path) Returns an instance of a single route, which you can then use to handle HTTP verbs with optional middleware. Use app.route() to avoid duplicate route names (and thus typo errors). var app = express() app. route(' /events') -all(function (req, res, next) { // vuns for all HTTP verbs first // think of it as route specific middleware! » -get(Function (req, res, next) { res. json({}) » spost(function (req, res, next) { // maybe add a new event... » app.set(name, value) Assigns setting name to value. You may store any value that you want, but certain names can be used to configure the behavior of the server. These special names are listed in the app settings table, Calling app.set(‘foo', true) for a Boolean property is the same as calling app.enable( 'foo' ). Similarly, calling app.set(‘foo', false) for a Boolean property is the same as calling app.disable( ‘foo' ) Retrieve the value of a setting with app. get(). hitpssexpressis.comfen4vapi.him! 26ssirorz024 Express 4 API Reference app.set(‘title’, ‘My Site’) app.get ("title") // "My Site” Application Settings The following table lists application settings. Note that sub-apps will: * Not inherit the value of settings that have a default value. You must set the value in the sub-app. * Inherit the value of settings with no default value; these are explicitly noted in the table below. Exceptions: Sub-apps will inherit the value of trust. proxy even though it has a default value (for backward-compatibility); Sub-apps will not inherit the value of view cache in production (when NODE_ENV is "production’) Property Type Description case sensitive routing Boolean Enable case sensitivity. When enabled, "/Foo" and "/foo" are different routes. When disabled, "/Foo" and "/foo" are treated the same. NOTE: Sub-apps will inherit the value of this setting. env String Environment mode. Be sure to set to “production” in a production environment; see Production best practices: performance and reliability. etag Varied Set the ETag response header. For possible values, see the etag options table. More about the HTTP ETag header. jsonp callback nane String Specifies the default JSONP callback name. hitpssfexpressis.comfeni4vapihim! Default N/A. (undefined) process.env. NODE_ENV (NOD EEN environment variable) or “development” iF NODE_ENV is not set. weak “callback” 2065siror2024 Property json escape json replacer json spaces query parser strict routing subdomain offset hitpssexpressis.comfeni4vapihim! Type Boolean Varied Varied Varied Boolean Number Express 4x API Reference Description Enable escaping JSON responses from the res. json, res.jsonp, and res.send APIs, This will escape the characters <, >, and & as Unicode escape sequences in JSON. The purpose of this it to assist with mitigating certain types of persistent XSS attacks when clients sniff responses for HTML. NOTE: Sub-apps will inherit the value of this setting, The 'replacer’ argument used by “JSON. stringity. NOTE: Sub-apps will inherit the value of this setting. The 'space' argument used by “JSON. stringify . This is typically set to the number of spaces to use to indent prettified JSON. NOTE: Sub-apps will inherit the value of this setting, Disable query parsing by setting the value to false, or set the query parser to use either “simple” or “extended” or a custom query string parsing function, The simple query parser is based on Node’s native query parser, querystring, ‘The extended query parser is based on 4s. Acustom query string parsing function will receive the complete query string, and must return an object of query keys and their values. Enable strict routing. When enabled, the router treats "/foo" and "/foo/" as different. Otherwise, the router treats "/foo" and "/foo/" as the same. NOTE: Sub-apps will inherit the value of this setting, The number of dot-separated parts of the host to remove to access subdomain. Default N/A, (undefined) N/A. (undefined) N/A (undefined) "extended" N/A (undefined) 2565ssarg02t Property Type trust proxy Varied views String or Array view cache Boolean view engine String x-powered-by Boolean Options for “trust proxy” setting Express 4x API Reference Description Indicates the app is behind a front-facing proxy, and to use the X-Forwarded-* headers to determine the connection and the IP address of the client. NOTE: X-Forw arded-* headers are easily spoofed and the detected IP addresses are unreliable When enabled, Express attempts to determine the IP address of the client connected through the front-facing proxy, or series of proxies. The *req.ips” property, then contains an array of IP addresses the client is connected through. To enable it, use the values described in the trust proxy options table. The “trust proxy” setting is implemented using the proxy-addr package. For more information, see its documentation. NOTE: Sub-apps will inherit the value of this setting, even though it has a default value. Adirectory or an array of directories for the application's views. If an array, the views are looked up in the order they occur in the array. Enables view template compilation caching, NOTE: Sub-apps will not inherit the value of this setting in production (when *NODE_ENV” is "production") The default engine extension to use when omitted. NOTE: Sub-apps will inherit the value of this setting. Enables the "X-Powered-By: Express” HTTP header. Read Express behind proxies for more information. Type hitpssfexpressis.comfeni4vapihim! Value Default false (disabled) process.cwd () + ‘/view 2 true in production, otherwise undefined. N/A. (undefined) true 26165sreara21 Type Boolean String String containing comma: separated values Array of strings Number Express 4x API Reference value If true, the client's IP address is understood as the left-most entry in the X-Forwar ded-* header. If false, the app is understood as directly facing the Internet and the client's IP address is derived from req. connection. renoteAddress. This is the default setting. An IP address, subnet, or an array of IP addresses, and subnets to trust. Pre- configured subnet names are: * loopback - 127.0.0.1/8, ::1/128 * linklocal - 169.254.0.0/16, Fe80: * uniquelocal - [email protected]/8, 172.16.0.0/12, 192.168.0.0/16, Fc08 Set IP addresses in any of the following ways: Specify a single subnet: app.set(‘trust proxy’, ‘Loopback') Specify a subnet and an address: app.set(‘trust proxy’, ‘loopback, 123.123.123.123") Specify multiple subnets as CSV: app.set(‘trust proxy’, ‘loopback, linklocal, uniquelocal') Specify multiple subnets as an array: app.set(‘trust proxy’, ['loopback', ‘linklocal', ‘uniquelocal']) When specified, the IP addresses or the subnets are excluded from the address determination process, and the untrusted IP address nearest to the application server is determined as the client's IP address. Trust the n™ hop from the front-facing proxy server as the client. hitpssexpressis.comfeni4vapihim! 2768siror2024 Express 4x API Reference Type Value Function Custom trust implementation. Use this only if you know what you are doing. app.set("trust proxy’, function (ip) { if (ip =2= '127.0.0.1" || ip === '123.123.123.123") return true // twusted IPs else return false Dv Options for “etag* setting NOTE: These settings apply only to dynamic files, not static files. The express.static middleware ignores these settings The ETag functionality is implemented using the etag package. For more information, see its documentation. Type Value Boolean true enables weak ETag. This is the default setting false disables ETag altogether. String If "strong", enables strong ETag, If "weak", enables weak ETag. Function Custom ETag function implementation. Use this only if you know what you are doing app.set(‘etag', function (body, encoding) { return generateHash(body, encoding) // consider the function is defined » app.use([path,] callback [, callback...]) Mounts the specified middleware function or functions at the specified path: the middleware function is. executed when the base of the requested path matches path. Arguments Argument Description Default path ‘The path for which the middleware function is invoked; can be any of: 1 (root path) ‘+ Astring representing a path. hitpssexpressis.comfen4vapi.him! 206siporz024 Express 4x API Reference * Apath pattern, © Aregular expression pattern to match paths. ‘+ An array of combinations of any of the above. For examples, see Path examples, callback Callback functions; can be: None ‘A middleware function. Aseries of middleware functions (separated by commas). An array of middleware functions. A combination of all of the above. You can provide multiple callback functions that behave just like middleware, except that these callbacks can invoke next(‘route" ) to bypass the remaining route callback(s). You can use this mechanism to impose pre-conditions on a route, then pass control to subsequent routes if there is no reason to proceed with the current route. Since router and app implement the middleware interface, you can use them as you would any other middleware function. For examples, see Middleware callback function examples. Description Aroute will match any path that follows its path immediately with a "/". For example: app.use(' /apple' +) will match “/apple’, “/apple/images’, "/apple/images/news’, and so on. Since path defaults to“ app. For example, this middleware function will be executed for every request to the app’ ", middleware mounted without a path will be executed for every request to the app.use(function (req, res, next) { console. log(‘Time: %d", Date.now()) next () » NOTE Sub-apps will + Not inherit the value of settings that have a default value. You must set the value in the sub-app. + Inherit the value of settings with no default value. For details, see Application settings. Middleware functions are executed sequentially, therefore the order of middleware inclusion is important. // this middleware will not allow the request to go beyond it app.use(function (req, res, next) { res.send(‘Hello World’) hitpssexpressis.comfen4vapi.him! 2065searzo2t Express 4x API Reference » // requests will never reach this route app.get('/", function (req, res) { res.send( ‘Welcome’ ) » Error-handling middleware Error-handling middleware always takes four arguments. You must provide four arguments to identify it as an error-handling middleware function. Even if you don't need to use the next object, you must specify it to maintain the signature. Otherwise, the next object will be interpreted as regular middleware and will fail to handle errors. For details about error-handling middleware, see: Error handling. Define error-handling middleware functions in the same way as other middleware functions, except with four arguments instead of three, specifically with the signature (err, req, res, next)): app.use(function (err, req, res, next) { console. error(err.stack) res. status(500) .send( ‘Something broke! ') » Path examples The following table provides some simple examples of valid path values for mounting middleware. Type Example Path This will match paths starting with /abed: app.use('/abed', function (req, res, next) { next () » hitpssexpressis.comfeni4vapihim! 20185siror2024 Express 4x API Reference Type Example Path Pattern This will match paths starting with /abed and /abd: app.use('/abc?d', function (req, res, next) { next () » This will match paths starting with /abed, /abbed, /abbbbbed, and so on: app.use('/ab+cd', function (req, res, next) { next () » This will match paths starting with /abed, /abxed, /abFOOcd, /abbarcd, and so on: app.use('/ab*cd", function (req, res, next) ¢ next() » This will match paths starting with /ad and /abcd: app-use('/a(bc)?d’, function (req, res, next) { next () » Regular This will match paths starting with /abe and /xyz: Expression app.use(/\/abc|\/xyz/, function (req, res, next) { next () » Array This will match paths starting with /abed, /xyza, /Imn, and /pqr: app.use(['/abcd", ‘/xyza", /\/1m|\/par/], function (req, res, next) { next () » < » Middleware callback function examples hitpssexpressis.comfen4vapihim! 21185ssrargo2t Express 4x API Reference The following table provides some simple examples of middleware functions that can be used as the call back argument to app.use(), app.METHOD(), and app.al1(). Even though the examples are for app.use(), they are also valid for app.use(), app-METHOD(), and app.al1(). Usage Single Middleware Series of Middleware hitpssfexpressis.comfeni4vapihim! Example You can define and mount a middleware function locally. app-use(function (req, res, next) { next() » Arrouter is valid middleware. var router = express.Router() router.get('/', function (req, res, next) { next() » app.use(router) ‘An Express app is valid middleware. var subApp = express() subApp.get('/", function (req, res, next) { next() » app-use(subApp) You can specify more than one middleware function at the same mount path. var Pl = express.Router() rl.get('/', function (req, res, next) { next () » var 2 = express.Router() r2.get('/", function (req, res, next) { next() » app.use(r1, 72) 22186siror2024 Express 4x API Reference Usage Example Array Use an array to group middleware logically. var Pl = express.Router() rl.get('/', function (req, res, next) { next() » var r2 = express.Router() r2.get('/', function (req, res, next) { next() » app.use([r1, r2]) Combination You can combine all the above ways of mounting middleware function mw (req, res, next) { next() } Function m2 (req, res, next) { next() ) var ri = express.Router() rLeget('/", function (req, res, next) { next() }) var 2 = express .Router() r2.get('/', function (req, res, next) { next() }) var subApp = express() subApp.get('/", function (req, res, next) { next() }) app-use(mwi, [mw2, ri, r2], subApp) Following are some examples of using the express.static middleware in an Express app. Serve static content for the app from the “public” directory in the application directory: // GET /style.css etc app.use(express.static(path. join(_dirname, ‘public'))) Mount the middleware at “/static” to serve static content only when their request path is prefixed with “istatic’ J/ GET /static/style.css etc. app.use('/static', express.static(path.join(_dirname, ‘public'))) hitpssexpressis.comfen4vapi.him! 3185syear2021 Express 4x API Reference Disable logging for static content requests by loading the logger middleware after the static middleware: app.use (express. static(path.join(_dirnane, ‘public'))) app-use(logger()) Serve static files from multiple directories, but give precedence to "/public” over the others: app.use (express. static(path.join(__dirname, ‘public'))) app.use(express. static(path. join(_dirname, ‘files’))) app.use (express. static(path. join(_dirname, ‘uploads'))) Request The req object represents the HTTP request and has properties for the request query string, parameters, body, HTTP headers, and so on. In this documentation and by convention, the object is always referred to as req (and the HTTP response is res) but its actual name is determined by the parameters to the callback function in which you're working. For example app.get("/user/:id", function (req, res) { res.send(‘user ' + req.parans. id) » But you could just as well have: app.get('/user/:id', function (request, response) { response.send(‘user ' + request.params.id) » The req object is an enhanced version of Node’s own request object and supports all built-in fields and methods. Properties In Express 4, req. files is no longer available on the req object by default, To access uploaded files on the req.f les object, use multipart-handling middleware like busboy, multer, formidable, multiparty, connect-multiparty, or pez. req.app This property holds a reference to the instance of the Express application that is using the middleware. If you follow the pattern in which you create a module that just exports a middleware function and requir e() it in your main file, then the middleware can access the Express instance via req. app hitpssexpressis.comfen4vapi.him! 2418sssrargo2t Express 4x API Reference For example: JI index. js app.get(' /viewdirectory", require('./mymiddleware.js')) // mymiddleware. js module.exports = function (req, res) ( res.send('The views directory is ' + req.app.get('views')) req.baseUrl The URL path on which a router instance was mounted The req.baseUrl property is similar to the mountpath property of the app object, except app.mountpath returns the matched path pattern(s). For example var greet = express.Router() greet.get('/jp', function (req, res) ¢ console. log(req.baseUrl) // /greet res.send(‘Konichiwa!') » app.use('/greet", greet) // load the router on '/greet’ Even if you use a path pattern or a set of path patterns to load the router, the baseUrl property returns the matched string, not the pattern(s). In the following example, the greet router is loaded on two path patterns, app.use({'/greit’, ‘/hel{2}0'], greet) // load the router on '/grett’ and '/hel{2}0" When a request is made to /greet/p, req. baseUrl is “/greet”. When a request is made to /hello/Jp, re g.baseUr is “/hello”. req.body Contains key-value pairs of data submitted in the request body. By default, itis undefined, and is populated when you use body-parsing middleware such as express. json() or express. urlencoded() The following example shows how to use body-parsing middleware to populate req. body. var express = require(‘express') var app = express() hitpssexpressis.comfen4vapihim! 6165searzo2t Express 4x API Reference app.use(express.json()) // for parsing application/ json app.use(express.urlencoded({ extended: true })) // for parsing application/x-waw-form- urlencoded app-post(‘/profile", function (req, res, next) { console. 1og( neq. body) res. json(req. body) » req.cookies When using cookie-parser middleware, this property is an object that contains cookies sent by the request. if the request contains no cookies, it defaults to (}. J/ Cookie: name=tj console.dir(req.cookies.name) J) => "th" IF the cookie has been signed, you have to use req.signedCookies, For more information, issues, or concerns, see cookie-parser. req.fresh When the response is still fresh’ in the client's cache true is returned, otherwise false is returned to indicate that the client cache is now stale and the full response should be sent. When a client sends the Cache-Control: no-cache request header to indicate an end-to-end reload request, this rnodule will return false to make handling these requests transparent. Further details for how cache validation works can be found in the HTTP/1.1 Caching Specification. console.dir(req. fresh) We true req.hostname Contains the hostname derived from the Host HTTP header. When the trust proxy setting does not evaluate to false, this property will instead get the value from the X-Forwarded-Host header field. This header can be set by the client or by the proxy. If there is more than one X-Forwarded-Host header in the request, the value of the first header is used This includes a single header with comma-separated values, in which the first value is used Prior to Express v4.17.0, the X-Forwarded-Host could nat contain multiple values or be present more than once. hitpssexpressis.comfen4vapi.him! 26185ssrargo2t Express 4x API Reference // Host: "example.com:3000" console.dir(req. hostname) J/ => ‘example.com’ req.ip Contains the remote IP address of the request. When the trust proxy setting does not evaluate to false, the value of this property is derived from the leftemost entry in the X-Forwarded-For header. This header can be set by the client or by the proxy. console. dir(req.ip) I) => 1127.0.0.1' req.ips When the trust proxy setting does not evaluate to false, this property contains an array of IP addresses specified in the X-Forwarded-For request header. Otherwise, it contains an empty array. This header can be set by the client or by the proxy. For example, if X-Forwarded-For is client, proxy1, proxy2, req.ips would be [“client", “proxy1", roxy" ], where proxy? is the furthest downstream. req.method Contains a string corresponding to the HTTP method of the request: GET, POST, PUT, and so on. req.originalUrl reqvurl is nota native Express property, iis inherited from Node's hep module This property is much like req.ur1; however, it retains the original request URL, allowing you to rewrite re q.url freely for internal routing purposes. For example, the “mounting” feature of app.use() will rewrite re q.url to strip the mount point. // Get /search?q=sonething console. dir(req-originalurl) 1] => * /search?q=sonething' req.originalUrl is available both in middleware and router objects, and is a combination of req. baseUr1 and req.url. Consider following example: app.use('/admin', function (req, res, next) { // GET "http://www. example. com/admin/new?sort=desc’ console.dir(req.originalurl) // '/admin/new?sort=desc" console.dir(req.baseUrl) // '/admin* hitpssexpressis.comfen4vapihim! 7185searzo2t Express 4x API Reference console.dir(req.path) // */new’ next() » req.params This property is an object containing properties mapped to the named route “parameters”, For example, if you have the route /user/:name, then the “name” property is available as req. params. nane, This object defaults to {} I) GET fuser/t3 console.dir(req.params.name) I) => *t3" When you use a regular expression for the route definition, capture groups are provided in the array using req.params[n], where nis the n*® capture group. This rule is applied to unnamed wild card matches with string routes such as /File/* // GET /File/javascripts/jquery.3s console.dir(req.parans[@]) 1) => “Javascripts/jquery.Js" If you need to make changes to a key in req. params, use the app.param handler. Changes are applicable only to parameters already defined in the route path ‘Any changes made to the req.parans object in a middleware or route handler will be reset. NOTE: Express automatically decodes the values in req.parans (using decodeURIComponent), req.path Contains the path part of the request URL. // example. com/users?sort=desc console. dir(req. path) // => *Jusers* When called from a middleware, the mount point is not included in req.path. See app.use() for more details req.protocol Contains the request protocol string: either http or (for TLS requests) https hitpssexpressis.comfen4vapi.him! ar6sssrargo2t Express 4x API Reference When the trust proxy setting does not evaluate to false, this property will use the value of the X-Forwar ded-Proto header field if present. This header can be set by the client or by the proxy. console.dir(req. protocol) J] => “http req.query This property is an object containing a property for each query string parameter in the route. When query parser is set to disabled, it is an empty object {}, otherwise it is the result of the configured query parser. ‘As req.query’s shape is based on user-controlled input, all properties and values in this object are untrusted and should be validated before trusting, For example, req.query. foo. toString() may fallin multiple ways, for example Foo may not be there or may not be a string, and toString may not be a function and instead a string or other user-input, J/ GET /search?q=tobitferret console. dir(req.query.q) J/ => ‘tobi ferret’ // GET /shoes?order=desc&shoe[ color]=blue&shoe[type]=converse console.dir(req.query.order) Ww "desc’ console. dir(req. query. shoe. color) JJ => *blue* console. dir(req.query.shoe. type) // => ‘converse’ // GET /shoes?color[]=blue&color[ ]=black&color[]=red console.dir(req.query.color) // => Ublue', "black", ‘red*] req.route Contains the currently-matched route, a string. For example app.get('/user/:id?", function userIdHandler (req, res) { console. 1og(req. route) res.send('GET") » Example output from the previous snippet: hitpssexpressis.comfen4vapi.him! 29185ssrargo2t Express 4x API Reference { path: '/user/:id?", stack: [ { handle: [Function: userIdHandler], nane: ‘useridHandler', params: undefined, path: undefined, keys: [], regexp: /*\/2$/i, method: "get’ } ], methods: { get: true } } req.secure Boolean property that is true if a TLS connection is established. Equivalent to console. dir(req. protocol J => true “hetps") req.signedCookies ‘When using cookie-parser middleware, this property contains signed cookies sent by the request, unsigned and ready for use. Signed cookies reside in a different object to show developer intent; otherwise, a malicious attack could be placed on req. cookie values (which are easy to spoof). Note that signing a cookie does not make it “hidden” or encrypted; but simply prevents tampering (because the secret used to sign is private) If no signed cookies are sent, the property defaults to {). J/ Cookie: user=tobi .CP7AWaXDFAKIRFHASdQzKIXx7skzzS0Pq7/ACBBRVWLI3 console.dir(req.signedCookies.user) J] => *tobi* For more information, issues, or concerns, see cookie-parser. req.stale Indicates whether the request is “stale,” and is the opposite of req. fresh. For more information, see req,fresh. console.dir(req.stale) J) => true req.subdomains An array of subdomains in the domain name of the request. hitpssexpressis.comfen4vapi.him! 4016sssrargo2t Express 4x API Reference // Host: “tobi. ferrets.example. com" console.dir(req. subdomains) J/ => ['ferrets", ‘tobi"] The application property subdomain offset, which defaults to 2, is used for determining the beginning of the subdomain segments. To change this behavior, change its value using app.set. req.xhr A Boolean property that is true if the request’s X-Requested-With header field is “XMLHttpRequest”, indicating that the request was issued by a client library such as jQuery. console.dir(req.xhr) J) => true Methods req.accepts(types) Checks if the specified content types are acceptable, based on the request's Accept HTTP header field. The method returns the best match, or if none of the specified content types is acceptable, returns false (in which case, the application should respond with 486 “Not Acceptable"). The type value may be a single MIME type string (such as “application/json’), an extension name such as “json”, a comma-delimited list, or an array. For a list or array, the method returns the best match (if any). // Accept: text/html req. accepts(‘html") 1) => “htm // accept: text/*, application/json req.accepts(‘html") 1) => html" req.accepts('text/html") // => “text/html req.accepts(["json’, ‘text']) I] => "js0 req. accepts( ‘application/json' ) J] => “application/json" // Accept: text/*, application/json req.accepts( image/png’) req.accepts('png') I] => false J/ Accept: text/*;q=.5, application/json hitpssexpressis.comfen4vapi.him! 4165,searzo2t Express 4x API Reference req.accepts(['html', NW json" ]) json" For more information, or if you have issues or concerns, see accepts. req.acceptsCharsets(charset [, ...]) Returns the first accepted charset of the specified character sets, based on the request’s Accept-Charset HTTP header field. If none of the specified charsets is accepted, returns false, For more information, or if you have issues or concerns, see accepts. 1) Returns the first accepted encoding of the specified encodings, based on the request's Accept-Encoding HTTP header field. If none of the specified encodings is accepted, returns false. req.acceptsEncodings(encoding |, For more information, or if you have issues or concerns, see accepts. req.acceptsLanguages(lang [, ...]) Returns the first accepted language of the specified languages, based on the request’s Accept-Language HTTP header field. If none of the specified languages is accepted, returns false. For more information, or if you have issues or concerns, see accepts. req.get(field) Returns the specified HTTP request header field (case-insensitive match). The Referrer and Referer fields are interchangeable. req.get(' Content-Type" ) J) => “text/plain* req.get('content-type' ) J) => “text/plain” req. get( ‘Something’ ) // => undefined Aliased as req.header (field) req.is(type) Returns the matching content type if the incoming request's "Content-Type" HTTP header field matches the MIME type specified by the type parameter. If the request has no body, returns null. Returns false otherwise. J/ With Content-Type: text/html; charset-utf-8 req. is('html') hitpssexpressis.comfen4vapi.him! 4268siroz024 Express 4 API Reference J) => ttm" req.is(‘text/html') // = “text/html req. is('text/*") J] => “text/** // when Content-Type is application/json req. is(' json") J] => "json" req.is(‘application/json') I] => ‘application/json* req.is(‘application/*') // => ‘application/** req. is('html') J] => false For more information, or if you have issues or concerns, see type-is. req.param(name [, defaultValue]) Deprecated, Use either req. parans, req. body or req. query, as applicable Returns the value of param name when present. J/ ?name=tobi req.param( ‘name’ ) J/ POST name=tobi req.param(‘name') J] => "tobi! J/ fuser/tobi for /user/:name req. param(’name") J] => "tobi" Lookup is performed in the following order: © req.params * req. body * req.query Optionally, you can specify defaultValue to set a default value if the parameter is not found in any of the request objects hitpssexpressis.comfen4vapi.him! 4216s,searz02t Express 4x API Reference Direct access to req. body, req.parans, and req.query should be favoured for clarity - unless you truly accept input from each object. Body-parsing middleware must be loaded for req. param() to work predictably. Refer req.body for deta req.range(: e[, options]) Range header parser. The size parameter is the maximum size of the resource. The options parameter is an object that can have the following properties. Property Type Description combine | Boolean Specify if overlapping & adjacent ranges should be combined, defaults to false. When true, ranges will be combined and returned as if they were specified that way in the header. ‘An array of ranges will be returned or negative numbers indicating an error parsing, © -2 signals a malformed header string © -1 signals an unsatisfiable range // parse header from request var range = req.range(1000) // the type of the range ‘if (range.type “bytes') { // the ranges range. for€ach(function (r) { // do something with r.start and r.end » Response The res object represents the HTTP response that an Express app sends when it gets an HTTP request. In this documentation and by convention, the object is always referred to as res (and the HTTP request is r eq) but its actual name is determined by the parameters to the callback function in which you're working, For example app.get('/user/:id’, function (req, res) { res.send(‘user ' + req. params. id) » hitpssexpressis.comfen4vapi.him! 4465sr20r2021 Express 4.x - API Reference: But you could just as well have: app.get(' /user/:id', function (request, response) ( response.send(‘user ' + request.params.id) » The res object is an enhanced version of Node’s own response object and supports all built-in fields and methods. Properties res.app This property holds a reference to the instance of the Express application that is using the middleware res .app is identical to the req. app property in the request object. res.headersSent Boolean property that indicates if the app sent HTTP headers for the response. app.get('/", function (req, res) { console. dir(res.headerssent) // false res.send('0K") console.dir(res.headersSent) // true » res.locals ‘An object that contains response local variables scoped to the request, and therefore available only to the view(s) rendered during that request / response cycle (if any). Otherwise, this property is identical to app.locals. This property is useful for exposing request-level information such as the request path name, authenticated user, user settings, and so on. app.use(function (req, res, next) { res.locals.user = req.user res. locals authenticated = Ireq.user. anonymous next() » Methods res.append(field [, value]) res append() is supported by Express v4.11.0+ hitpssexpressis.comfen4vapi.him! 4565seargo2t Express 4x API Reference ‘Appends the specified value to the HTTP response header field. If the header is not already set, it creates, the header with the specified value. The value parameter can be a string or an array. Note: calling res.set() after res.append()) will reset the previously-set header value. res.append('Link', ['", '" ]) res.append('Set-Cookie', 'foo=bar; Path=/; HttpOnly") res. append(‘Warning', '199 Miscellaneous warning’) res.attachment([filename]) Sets the HTTP response Content -Disposition header field to “attachment”. If a Filename is given, then it sets the Content-Type based on the extension name via res. type(), and sets the Content-Disposition “filename=" parameter. res.attachment() // Content-Disposition: attachment res.attachment(' path/to/logo.png" ) // Content-Disposition: attachment; filename="Logo.png” // Content-Type: image/png res.cookie(name, value [, options]) Sets cookie name to value, The value parameter may be a string or object converted to JSON. The options parameter is an object that can have the following properties. Property Type Description domain | String Domain name for the cookie. Defaults to the domain name of the app. encode Function A synchronous function used for cookie value encoding. Defaults to encodeuRIC component. expires | Date | Expiry date of the coolde n GMT. not specified or set to creates a session cookie httponly | Boolean Flags the cookie to be accessible only by the web server. maxAge Number Convenient option for setting the expiry time relative to the current time in milliseconds. path String Path for the cookie, Defaults to", secure | Boolean Marks the cookie to be used with HTTPS only. signed Boolean _ Indicates if the cookie should be signed. sameSite Boolean Value of the "SameSite” Set-Cookie attribute. More information at or String _ https://tools.ietf.org/htmi/draft ietf-httpbis-cookie-same-site-OO#Section-4.1.1. hitpssexpressis.comfen4vapi.him! 466ssyz0r2024 Express 4 API Reference Allres.cookie() does is set the HTTP Set-Cookie header with the options provided. Any option not specified defaults to the value stated in RFC 6265. For example: res.cookie(‘name’, ‘tobi’, { domain: ‘.example.com’, path: '/admin’, secure: true }) res.cookie(‘rememberme', '1', { expires: new Date(Date.now() + 900000), httpOnly: true » You can set multiple cookies in a single response by calling res. cookie multiple times, for example: res -status(201) .cookie(‘access_token’, ‘Bearer ' + token, { : new Date(Date.now() + 8 * 3680000) // cookie will be removed after 8 scookie(‘test', ‘test’) -redirect(301, '/admin') The encode option allows you to choose the function used for cookie value encoding. Does not support asynchronous functions. Example use case: You need to set a domain-wide cookie for another site in your organization, This other site (not under your administrative control) does not use URI-encoded cookie values. // Default encoding res. cookie(' some_cross_domain_cookie’, ‘http://mysubdomain.example.com’, { domain: ‘example.com' }) // Result: ‘some_cross_domain_cookie=https%3a%2F%2Ffanyv88.com%3a443%2Fhttp%2Fnysubdomain. example. com; Domain=example.con; Path=/' // Custom encoding res. cookie(' some_cross_domain_cookie’, ‘http://nysubdomain.example.com', { domain: “example.com', encode: String }) // Result: ‘some_cross_domain_cookie=http://mysubdonain.example.com; Domain=example.com; Path=/; ‘The maxage option is a convenience option for setting “expires” relative to the current time in milliseconds, The following is equivalent to the second example above res.cookie('rememberme’, '1', { maxAge: 980000, httpOnly: true }) You can pass an object as the value parameter; itis then serialized as JSON and parsed by bodyParser() middleware. hitpssexpressis.comfen4vapi.him! 4718sssrargo2t Express 4x API Reference res.cookie(‘cart', { items: [1, 2, 3] }) [1, 2, 3] }, { maxage: 98000 }) res.cookie(‘cart', { item When using cookie-parser middleware, this method also supports signed cookies. Simply include the sign ed option set to true. Then res. cookie) will use the secret passed to cookieParser(secret) to sign the value res.cookie(‘name’, ‘tobi', { signed: true }) Later you may access this value through the req,signedCookie object. res.clearCookie(name [, options]) Clears the cookie specified by name. For details about the options object, see res.cookiel). Web browsers and other compliant clients will only lear the cookie ifthe given options is identical to those given to res.cookie(), excluding expires and maxage res.cookie(‘nane’, ‘tobi", { path: "/admin’ }) res.clearCookie(‘name’, { path: */admin’ }) res.download(path [, filename] [, options] [, fn]) ‘The optional options argument is supported by Express v4.16.0 onwards, Transfers the file at path as an “attachment”. Typically, browsers will prompt the user for download, By default, the Content -Disposition header “filename=" parameter is path (this typically appears in the browser dialog). Override this default with the filename parameter. When an error occurs or transfer is complete, the method calls the optional callback function fn. This method uses res.sendFile() to transfer the file. ‘The optional options argument passes through to the underlying res.sendFile() call, and takes the exact same parameters. res .download(' /report -12345.pdf") res. download(' /report-12345.pdf", 'report.pdf') res .download(' /report-12345.pdf', ‘report.pdf*, function (err) { if (err) ¢ // Handle error, but keep in mind the response may be partially-sent // so check res.headersSent y else { // decrement a download credit, etc. hitpsifexpressis.conven/4xapi. html 48005syz0r2024 Express 4x API Reference 3 » res.end([data] [, encoding]) Ends the response process. This method actually comes from Node core, specifically the response.end() method of http.ServerResponse. Use to quickly end the response without any data. If you need to respond with data, instead use methods such as res.send() and res,son(. res.end() res. status (404) .end() res.format(object) Performs content-negotiation on the Accept HTTP header on the request object, when present, It uses req.accepts() to select a handler for the request, based on the acceptable types ordered by their quality values. if the header is not specified, the first callback is invoked. When no match is found, the server responds with 406 “Not Acceptable”, or invokes the default callback. ‘The Content -Type response header is set when a callback is selected. However, you may alter this within the callback using methods such as res. set() or res.type(). ‘The following example would respond with { "message": “hey” } when the Accept header field is set to “application/json” or “*/json” (however if itis “*/*", then the response will be “hey’) res. format ({ ‘text/plain’: function () { res.send(‘hey’) b “text/html': function () { res. send

hey

') hb ‘application/json': function () { res.send({ message: ‘hey’ }) he default: function () { // 10g the request and respond with 406 res. status (406).send('Not Acceptable") 3 » In addition to canonicalized MIME types, you may also use extension names mapped to these types for a slightly less verbose implementation: hitpssexpressis.comfen4vapi.him!ssrargo2t Express 4x API Reference res. format({ text: function () { res.send(‘hey’) b html: function () { res. send('

hey

') hb json: function () { res.send({ message: ‘hey’ )) y » res.get(field) Returns the HTTP response header specified by field. The match is case-insensitive, res.get('Content-Type') I) => “text/plain res,json([body]) Sends a JSON response. This method sends a response (with the correct content-ype) that is the parameter converted to a JSON string using JSON.stringify() The parameter can be any JSON type, including object, array, string, Boolean, number, or null, and you can also use it to convert other values to JSON. res. json(null) res.json({ user: ‘tobi’ }) res. status (580). json({ error ‘message’ }) res.jsonp([body]) Sends a JSON response with JSONP support. This method is identical to res. json(), except that it opts-in to JSONP callback support. res. jsonp(null) // => callback(null) res.jsonp({ user: ‘tobi’ }) J/ => callback({ "user": obi" }) hitpssexpressis.comfen4vapi.him! 5018ssyz0r2024 Express 4x API Reference res.status(5@@).jsonp({ error: ‘message’ }) // => callback({ "error": “message” }) By default, the JSONP callback name is simply callback. Override this with the jsonp callback nae setting The following are some examples of JSONP responses using the same code: // 2callback=foo res. jsonp({ user: ‘tobi’ }) J] => foo({ “user”: "tobi" }) app.set('jsonp callback name’, ‘cb') 1] 2cb=Foo res. status (580). jsonp({ error: ‘message’ }) // => foo({ "error": “message” }) res.links(links) Joins the Links provided as properties of the parameter to populate the response’s Link HTTP header field For example, the following call: res. links ({ next: ‘http: //api.example.com/users?page=2' , last: ‘http: //api-example.com/users?page=5' » Yields the following results: Link: ‘/api.example.com/users?page=2>; rel="next", ://api.exanple.com/users?page-5>; rel="last" res.locat in(path) Sets the response Location HTTP header to the specified path parameter. res.location('/foo/bar') res. location( ‘http: //example. com’) res. location(‘back') A path value of "back" has a special meaning, it refers to the URL specified in the Referer header of the request. If the Referer header was not specified, it refers to“/", hitpssexpressis.comfen4vapi.him! S16searz02t Express 4x API Reference After encoding the URL, if not encoded already, Express passes the specified URL to the browser in the Location header, without any validation Browsers take the responsibilty of deriving the intended URL from the current URL or the referring URL, and the URL specified in the Location header; and redirect the user accordingly. res.redirect([status,] path) Redirects to the URL derived from the specified path, with specified status, a positive integer that corresponds to an HTTP status code . If not specified, status defaults to "302 “Found” res.redirect(' /foo/bar') res.redirect( ‘http: //example.con* ) res.redirect(301, ‘http: //example.com’) res.redirect(*../login') Redirects can be a fully-qualified URL for redirecting to a different site: res.redirect( ‘http: //google. com’) Redirects can be relative to the root of the host name. For example, if the application is on http: //exampl e..com/admin/post/new, the following would redirect to the URL http: //example. com/admin: res.redirect('/admin') Redirects can be relative to the current URL. For example, from http: //example.com/blog/admin/ (notice the trailing slash), the following would redirect to the URL http: //example. com/blog/admin/post/new. res.redirect(‘post/new') Redirecting to post/new from http://example..com/b1og/adnin (no trailing slash), will redirect to http:// example. com/blog/post/new, Ifyou found the above behavior confusing, think of path segments as directories (with trailing slashes) and files, it will start to make sense. Path-relative redirects are also possible. If you were on http: //example.con/admin/post/new, the following would redirect to http: //example. com/admin/post: res.redirect(‘..') A back redirection redirects the request back to the referer, defaulting to / when the referer is missing, res.redirect(‘back') res.render(view [, locals] [, callback] hitpssexpressis.comfen4vapi.him! 5216ssyear2021 Express 4x API Reference Renders a view and sends the rendered HTML string to the client, Optional parameters: * locals, an object whose properties define local variables for the view. * callback, a callback function. If provided, the method returns both the possible error and rendered string, but does not perform an automated response. When an error occurs, the method invokes nex t(err) internally. ‘The view argument is a string that is the file path of the view file to render. This can be an absolute path, or a path relative to the views setting. If the path does not contain a file extension, then the view engine setting determines the file extension. If the path does contain a file extension, then Express will load the module for the specified template engine (via require()) and render it using the loaded module’s _expre ss function, For more information, see Using template engines with Express. NOTE: The view argument performs file system operations like reading a file from disk and evaluating Node,js modules, and as so for security reasons should not contain input from the end-user. ‘The local variable cache enables view caching, Set it to true, to cache the view during development; view caching is enabled in production by default // send the rendered view to the client res.render('index') // if a callback is specified, the rendered HTML string has to be sent explicitly res.render(‘index', function (err, html) { res. send(html) » // pass a local variable to the view res.render(‘user', { name: ‘Tobi’ }, function (err, html) { Move » res.send([body]) Sends the HTTP response. The body parameter can be a Buffer object, a String, an object, Boolean, or an Array. For example: res. send(Buffer. from( whoop") res.send({ some: ‘json’ }) res.send("

some html

") res.status(404).send(*Sorry, we cannot find that!") res.status(500).send({ error: ‘something blew up’ }) This method performs many useful tasks for simple non-streaming responses: For example, it automatically assigns the Content -Length HTTP response header field (unless previously defined) and hitpssexpressis.comfen4vapi.him! saves,syporz0et Express 4x API Reference provides automatic HEAD and HTTP cache freshness support. When the parameter is a Buffer object, the method sets the Content-Type response header field to “application/octet-stream’, unless previously defined as shown below: res.set(*Content-Type’, ‘text/html') res. send(Buffer.from('

some htnl

')) When the parameter is a String, the method sets the Content-Type to “text/htm!" res.send(‘

sone html

') When the parameter is an Array or Object, Express responds with the JSON representation: res.send({ user: ‘tobi’ }) res.send([1, 2, 3]) res.sendFile(path [, options] [, fn]) res. sendFile() is supported by Express v4.8.0 onwards, Transfers the file at the given path. Sets the Content-Type response HTTP header field based on the filename's extension. Unless the root option is set in the options object, path must be an absolute path to the file, ‘This API provides access to data on the running file system. Ensure that either (a) the way in which the path argument was constructed into an absolute path is secure if t contains user input or (b) set the rast option to the absolute path of a directory to contain access within, When the root option is provided, the path argument is allowed to be a relative path, including containing . . Express will validate that the relative path provided as path will resolve within the given root option. The following table provides details on the options parameter. Property Description Default Availability maxAge Sets the max-age property of the Cache-Control header in 0 milliseconds or a string in ms format root Root directory for relative filenames. lastModi | Sets the Last Modified header to the last modified date of Enabled | 4,9.0+ fied the file on the OS. Set false to disable it. headers | Object containing HTTP headers to serve with the file. dotfiles | Option for serving dotfiles. Possible values are “allow”, “ignore” “deny’, “ignore". hitpssfexpressis.comfeni4vapihim! saessarg02t Express 4x API Reference Property Description Default Availability acceptRa | Enable or disable accepting ranged requests. true 414+ nges cachecon Enable or disable setting Cache-Control response header. true 4.14+ trol immutabl | Enable or disable the inmutable directive inthe Cache-Cont false 4.16+ e rol response header. If enabled, the maxAge option should also be specified to enable caching. The inmutable directive will prevent supported clients from making conditional requests during the life of the maxAge option to check if the file has changed, 4 » The method invokes the callback function fn(err) when the transfer is complete or when an error occurs. If the callback function is specified and an error occurs, the callback function must explicitly handle the response process either by ending the request-response cycle, or by passing control to the next route. Here is an example of using res. sendFile with all its arguments, app.get('/file/:name', function (req, res, next) { var options = { root: path. join(_dirname, ‘public'), dotfiles: ‘deny’, headers: { ‘x-timestamp': Date.now(), ‘x-sent': true var fileName = req.params.name res.sendFile(fileName, options, function (err) { if (err) { next (err) } else ¢ console. log("Sent:', fileName) , » » The following example illustrates using res. sendFile to provide fine-grained support for serving files: app.get(' /user/:uid/photos/:file’, function (req, res) { var wid = req.parans uid var file = req.params.file req.user.mayViewFilesFrom(uid, function (yes) { hitpssexpressis.comfen4vapihim! 55165searzo2t Express 4x API Reference if (yes) { res.sendFile('/uploads/' + uid + '/' + file) } else { res. status(4@3).send("Sorry! You can't see that.") ? » » For more information, or if you have issues or concerns, see send. res.sendStatus(statusCode) Sets the response HTTP status code to statusCode and sends its string representation as the response body. res.sendStatus(200) // equivalent to res. status(200).send(‘OK') res.sendStatus(403) // equivalent to res.status(4@3).send( ‘Forbidden’ ) res.sendStatus(404) // equivalent to res.status(4e4).send('Not Found") res.sendStatus(5@@) // equivalent to res. status(5@@).send('Internal Server Error’) fan unsupported status code is specified, the HTTP status is still set to statusCode and the string version of the code is sent as the response body. Some versions of Node, will throw when res. statusCoce is set to an invalid HTTP status code (outside of the range 109 to 599). Consult the HTTP server documentation for the Node,js version being used, res.sendStatus(9999) // equivalent to res. status(9999) .send('9999") More about HTTP Status Codes res.set(field [, value]) Sets the response’s HTTP header field to value. To set multiple fields at once, pass an object as the parameter. res.set('Content-Type', ‘text/plain') res.set({ ‘content-Type’: ‘text/plain’, ‘Content-Length’: '123', ETag: '12345° » Aliased as res.header(Field [, value]). hitpssexpressis.comfen4vapi.him! eressirorz024 Express 4 API Reference res.status(code) Sets the HTTP status for the response. Itis a chainable alias of Node’s response.statusCode. res. status (403) .end() res. status (400).send('Bad Request") res.status (404). sendFile(' /absolute/path/to/404.png") res.type(type) Sets the Content-Type HTTP header to the MIME type as determined by mime.lookup() for the specified ty pe. If type contains the” character, then it sets the Content-Type to type. res.type(*.html*) // => ‘text/html! res.type(‘html") J] => text/html" res. type( json’) J/ => ‘application/json* res. type( ‘application/json") // => “application/json* res.type( png") J] => "image/png" res.vary(field) ‘Adds the field to the Vary response header, if it is not there already. res. vary(‘User-Agent') render('docs") Router Arouter object is an isolated instance of middleware and routes. You can think of it as a "mini- application,” capable only of performing middleware and routing functions. Every Express application has a built-in app router. Arouter behaves like middleware itself, so you can use it as an argument to app.use() of as the argument to another router's use() method. The top-level express object has a Router() method that creates a new router object. Once you've created a router object, you can add middleware and HTTP method routes (such as get, put, p ost, and so on) to it just like an application. For example: // invoked for any requests passed to this router router.use(function (req, res, next) ( hitpssexpressis.comfen4vapi.him! 5718ssearzo2t Express 4x API Reference // s+ some logic here .. like any other middleware next() » // will handle any request that ends in /events // depends on where the router is “use()'d" router.get('/events', function (req, res, next) { Moe » You can then use a router for a particular root URL in this way separating your routes into files or even mini-apps // only requests to /calendar/* will be sent to our “router” app. use(' /calendar’, router) Methods router.all(path, [callback, ...] callback) This method is just like the router .METHOD() methods, except that it matches all HTTP methods (verbs). This method is extremely useful for mapping “global” logic for specific path prefixes or arbitrary matches. For example, if you placed the following route at the top of all other route definitions, it would require that all routes from that point on would require authentication, and automatically load a user. Keep in mind that these callbacks do not have to act as end points; loadUser can perform a task, then call next() to continue matching subsequent routes. router.all('*', requireauthentication, loaduser) Or the equivalent router.all('*', requireauthentication) router.all('*', loaduser) Another example of this is white-listed “global functionality. Here the example is much like before, but it only restricts paths prefixed with "/api” router.all('/api/*', requireduthentication) router.METHOD(path, [callback, callback) The router.METHOD() methods provide the routing functionality in Express, where METHOD is one of the HTTP methods, such as GET, PUT, POST, and so on, in lowercase. Thus, the actual methods are router.get (), router. post(), router. put (), and so on. hitpssexpressis.comfen4vapi.him! satessy20r2024 xpress 4 API Reference ‘The router. get() function is automatically called for the HTTP HEAD method in addition to the GET method if rou ‘ter-head() was not called for the path before router. get() You can provide multiple callbacks, and all are treated equally, and behave just like middleware, except that these callbacks may invoke next ‘route" ) to bypass the remaining route callback(s). You can use this mechanism to perform pre-conditions on a route then pass control to subsequent routes when there is no reason to proceed with the route matched. ‘The following snippet illustrates the most simple route definition possible. Express translates the path strings to regular expressions, used internally to match incoming requests. Query strings are not considered when performing these matches, for example "GET /" would match the following route, as would "GET /?name=tobi’. router.get(‘/', function (req, res) { res.send(‘hello world") » You can also use regular expressions—useful if you have very specific constraints, for example the following would match “GET /commits/71dbb9c" as well as “GET /cornmits/71 dbb9c..4cO84F9" router. get(/*\/commits\/(\w+)(?:\.\.(\w+))?$/, function (req, res) { var from = req.parans[0] var to = req.params[2] || ‘HEAD’ res.send(‘conmit range ' + from + » + to) router.param(name, callback) Adds callback triggers to route parameters, where name is the name of the parameter and callback is the callback function. Although name is technically optional, using this method without it is deprecated starting with Express v4.1.0 (see below). ‘The parameters of the callback function are: * req, the request object. * res, the response object. * next, indicating the next middleware function, © The value of the name parameter. * The name of the parameter. Unlike app-paran(), router. param() does not accept an array of route parameters. For example, when :user is present in a route path, you may map user loading logic to automatically provide req. user to the route, or perform validations on the parameter input. router.param(‘user', function (req, res, next, id) { // try to get the user details from the User model and attach it to the request hitpssexpressis.comfen4vapihim! sossyz0r2024 Express 4x API Reference object User. find(id, function (err, user) ( if (err) { next(err) } else if (user) { req.user = user next () } else { next(new Error('failed to load user')) } » » Param callback functions are local to the router on which they are defined. They are not inherited by mounted apps or routers. Hence, param callbacks defined on router will be triggered only by route parameters defined on router routes Aparam callback will be called only once in a request-response cycle, even if the parameter is matched in multiple routes, as shown in the following examples. router.param('id', function (req, res, next, id) ¢ console. log( “CALLED ONLY ONCE") next() » router.get(‘/user/:id', function (req, res, next) { console.log("although this matches") next() » router.get(‘/user/:id', function (req, res) { console. log(*and this matches too’) res.end() » On GET /user/42, the following is printed: CALLED ONLY ONCE although this matches and this matches too ‘The following section describes router. param(callback), which is deprecated as of v4.11.0. ‘The behavior of the router.param(name, callback) method can be altered entirely by passing only a function to router. param( ). This function is a custom implementation of how router.param(name, call back) should behave - it accepts two parameters and must return a middleware. hitps:ifexpressis.cmven/4xapi. html 60185sirorz024 Express 4 API Reference The first parameter of this function is the name of the URL parameter that should be captured, the second parameter can be any JavaScript object which might be used for returning the middleware implementation, The middleware returned by the function decides the behavior of what happens when a URL parameter is captured. In this example, the router.param(name, callback) signature is modified to router.param(name, acces Td). Instead of accepting a name and a callback, router.param() will now accept a name and a number. var express = require('express') var app = express() var router = express.Router() J/ customizing the behavior of router.param() router.param(function (param, option) { return function (req, res, next, val) { if (val === option) ¢ next(), } else { res.sendStatus (403) } + » // using the customized router.param() router.param("id', '1337") // route to trigger the capture router.get(‘/user/:id', function (req, res) { res.send(‘OK") » app. use(router) app. listen(30@0, function () { console. log(‘ Ready’) » In this example, the router.param(name, callback) signature remains the same, but instead of a middleware callback, a custom data type checking function has been defined to validate the data type of the user id router.param(function (param, validator) ( return function (req, res, next, val) { if (validator(val)) { next(), } else { hitpssexpressis.comfen4vapihim! Crdsearzo2t Express 4x API Reference res. sendStatus (403) } » router.paran(‘id', function (candidate) { return lisNaN(parseFloat (candidate) 8& isFinite(candidate) » router.route(path) Returns an instance of a single route which you can then use to handle HTTP verbs with optional middleware. Use router.route() to avoid duplicate route naming and thus typing errors. Building on the router.param() example above, the following code shows how to use router.route() to specify various HTTP method handlers. var router = express.Router() router.param(‘user_id’, function (req, res, next, id) // sample user, would actually fetch from 0B, etc... req.user : id, name: °T3" + next() » router.route('/users/:user_id') sll (function (req, res, next) ( // vuns for all HTTP verbs first // think of it as route specific middleware! next() » aget (function (req, res, next) { res. json(req.user) » -put(Function (neq, res, next) { // just an example of maybe updating the user req.user.name = req.params.name // save user ... etc res. json(req.user) » -post (function (req, res, next) { next (new Error(‘not implenented')) » -delete(function (req, res, next) { hitpssexpressis.comfen4vapi.him! 6ssearzo2t Express 4x API Reference next(new Error(‘not implemented’ )) » This approach re-uses the single /users/:user_id path and adds handlers for various HTTP methods. NOTE: When you use router.route(), middleware ordering is based on when the routelis created, not when method handlers are added to the route. For this purpose, you can consider method handlers to belong to the route to which they were added, router.use([path], [function, ...] function) Uses the specified middleware function or functions, with optional rnount path path, that defaults to "/”. This method is similar to app.use(). A simple example and use case is described below. See app.use() for more information. Middleware is like a plumbing pipe: requests start at the first middleware function defined and work their way “down” the middleware stack processing for each path they match var express = require(‘express') var app = express() var router = express.Router() // simple logger for this router's requests // all requests to this router will first hit this middleware router.use(function (req, res, next) { console.log("%s %s %s', req.method, req.url, req.path) next() » // this will only be invoked if the path starts with /bar from the mount point router.use('/bar’, function (req, res, next) ( // ++. maybe some additional /bar logging ... next() » // always invoked router.use(function (req, res, next) ( res.send( ‘Hello World") » app-use("/foo", router) app. Listen (3000) The “mount” path is stripped and is not visible to the middleware function. The main effect of this feature is that a mounted middleware function may operate without code changes regardless of its “prefix” hitpssexpressis.comfen4vapi.him! eaves,ssrargo2t Express 4x API Reference pathname The order in which you define middleware with router .use() is very important. They are invoked sequentially, thus the order defines middleware precedence. For example, usually a logger is the very first middleware you would use, so that every request gets logged var logger = require('morgan’) var path = require('path') router. use(logger()) router.use(express.static(path. join(_dirname, ‘public’))) router.use(function (req, res) { res.send(‘Hello') » Now suppose you wanted to ignore logging requests for static files, but to continue logging routes and middleware defined after logger(). You would simply move the call to express.static() to the top, before adding the logger middleware: router .use(express.static(path.join(__dirname, ‘public'))) router.use(logger()) router.use(function (req, res) { res.send(‘Hello') » Another example is serving files from multiple directories, giving precedence to “/public” over the others: router.use(express.static(path. join(_dirname, ‘public’))) router. use (express. static(path. join(_dirname, ‘files'))) router. use(express. static(path. join(_dirname, ‘uploads'))) ‘The router.use() method also supports named parameters so that your mount points for other routers can benefit from preloading using named parameters. NOTE: Although these middleware functions are added via a particular router, when they run is defined by the path they are attached to (not the router), Therefore, middleware added via one router may run for other routers if its routes match. For example, this code shows two different routers mounted on the same path: var authRouter = express.Router() var openRouter = express. Router() authRouter.use(require(. /authenticate').basic(usersdb)) authRouter.get(‘/:user_id/edit', function (req, res, next) ( 71 ss. Edit user UT. » openkouter.get('/', function (req, res, next) ( hitpssexpressis.comfen4vapi.him! Crd