Express.js Cheat Sheet

Last Updated: November 21, 2025

Basic Server Setup

const express = require('express');
const app = express();

// Middleware
app.use(express.json());  // Parse JSON bodies
app.use(express.urlencoded({ extended: true }));

// Routes
app.get('/', (req, res) => {
  res.send('Hello World');
});

app.listen(3000, () => {
  console.log('Server running on port 3000');
});

Routing

// Basic routes
app.get('/users', (req, res) => {
  res.json({ users: [] });
});

app.post('/users', (req, res) => {
  const user = req.body;
  res.status(201).json(user);
});

// Route parameters
app.get('/users/:id', (req, res) => {
  const userId = req.params.id;
  res.json({ id: userId });
});

// Query parameters
app.get('/search', (req, res) => {
  const query = req.query.q;
  res.json({ query });
});

// Router
const router = express.Router();
router.get('/', (req, res) => {});
app.use('/api', router);

Middleware

// Application-level middleware
app.use((req, res, next) => {
  console.log('Time:', Date.now());
  next();
});

// Router-level middleware
router.use((req, res, next) => {
  console.log('Request URL:', req.originalUrl);
  next();
});

// Error-handling middleware
app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(500).send('Something broke!');
});

// Built-in middleware
app.use(express.static('public'));
app.use(express.json());

Response Methods

Method Description
res.send() Send response (auto-detects type)
res.json() Send JSON response
res.status() Set HTTP status code
res.sendFile() Send file
res.redirect() Redirect to URL
res.render() Render template

Common Patterns

// Async error handling
const asyncHandler = fn => (req, res, next) => {
  Promise.resolve(fn(req, res, next)).catch(next);
};

app.get('/users', asyncHandler(async (req, res) => {
  const users = await User.find();
  res.json(users);
}));

// CORS
const cors = require('cors');
app.use(cors());

// Rate limiting
const rateLimit = require('express-rate-limit');
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100
});
app.use(limiter);
💡 Pro Tip: Always use helmet.js for basic security headers in production!
← Back to Web Frameworks | Browse all categories | View all cheat sheets