Express.js Cheat Sheet

Updated 2026-04-28

🧠Study flashcards on this topic156 cards · spaced repetition→

Express.js is a minimal and flexible Node.js web application framework that provides a robust set of features for building web and mobile applications. It sits atop Node.js as a de facto standard server framework for REST APIs, web applications, and microservices. Express 5 (released October 2024) modernizes the framework by requiring Node.js 18+, automatically forwarding rejected promises to error handlers, tightening route-pattern security via path-to-regexp v8, and adding native Brotli compression support. Understanding middleware execution order, asynchronous error handling patterns, and the request-response lifecycle is essential for leveraging Express effectively in production.

What This Cheat Sheet Covers

This topic spans 28 focused tables and 197 indexed concepts, 156 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: Core Application MethodsTable 2: HTTP Route MethodsTable 3: Routing and Path MatchingTable 4: Router for Modular RoutingTable 5: Middleware TypesTable 6: Request Object PropertiesTable 7: Response Object MethodsTable 8: Body ParsingTable 9: Static File ServingTable 10: Template EnginesTable 11: Error HandlingTable 12: Validation and SanitizationTable 13: Security MiddlewareTable 14: Session and AuthenticationTable 15: File Upload HandlingTable 16: LoggingTable 17: Performance OptimizationTable 18: TestingTable 19: Environment ConfigurationTable 20: Database Integration PatternsTable 21: Real-Time CommunicationTable 22: GraphQL IntegrationTable 23: API VersioningTable 24: Express 5 Migration ChangesTable 25: TypeScript IntegrationTable 26: Health Checks and Graceful ShutdownTable 27: OpenAPI/Swagger DocumentationTable 28: Background Job Processing

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: Core Application Methods

These are the methods you call on the app object itself — the ones that boot the server, mount middleware, and tune how the whole application behaves. app.use() and app.listen() show up in nearly every Express file, while settings like app.disable('x-powered-by') and app.enable('trust proxy') are the small touches that make an app production-ready.

Method	Example	Description
app.listen()	`app.listen(3000, () => console.log('Server running'))`	Starts the Express application and binds it to a specified port, listening for incoming HTTP requests.
app.use()	`app.use(express.json())` `app.use('/api', routes)`	• Mounts middleware functions at a specified path • executes for every request matching that path, or globally if no path specified.
app.set()	`app.set('view engine', 'ejs')` `app.set('port', 3000)`	• Assigns a configuration setting to a name • used for application-level settings like template engine or custom properties.
app.get() (setting)	`const port = app.get('port')`	Retrieves the value of a setting previously assigned with `app.set()`.
app.locals	`app.locals.title = 'My App'`	Object containing application-level variables accessible throughout the app's lifecycle, including inside templates.
app.enable()	`app.enable('trust proxy')`	• Sets a boolean setting to `true` • enables features like proxy trust for correct IP detection behind load balancers.
app.disable()	`app.disable('x-powered-by')`	• Sets a boolean setting to `false` • commonly used to remove the `X-Powered-By` header for security.
app.param()	`app.param('id', (req, res, next, id) => { next() })`	• Adds callback triggers for route parameters • executes middleware whenever a specific named parameter is present.
app.router	`const router = app.router`	• Returns a reference to the base router instance (reintroduced in Express 5) • simplifies route management without explicit initialization.
app.path()	`app.path() // '/admin'`	• Returns the canonical path of the mounted sub-app or router • useful for debugging complex mount hierarchies.

Table 2: HTTP Route Methods

One method per HTTP verb — get, post, put, patch, delete, and the less common options and head. Mapping verbs to handlers this way is the heart of building a REST API, and the descriptions note which verbs should stay idempotent and safe.

Method	Example	Description
app.get()	`app.get('/users', (req, res) => res.json(users))`	• Handles HTTP GET requests to retrieve resources • should be idempotent and safe (no side effects).

The rest of this section is part of the full cheat sheet

Table 3: Routing and Path Matching

How a URL string actually gets matched to a handler — capturing dynamic :id segments, chaining methods on a single path, and constraining matches with patterns or regex. Several rows flag where Express 5 changed the rules, since wildcards must now be named and optional segments use the new {/...} curly-brace syntax instead of the old :id?.

Pattern	Example	Description
Route parameters	`app.get('/users/:id', (req, res) => { })` `req.params.id`	• Captures dynamic URL segments prefixed with colon • values accessible via `req.params`.

The rest of this section is part of the full cheat sheet

Table 4: Router for Modular Routing

Once an app grows past a handful of routes, express.Router() lets you split them into separate files and mount each group under a path prefix. These features cover the building blocks of that structure — nesting routers, scoping middleware to a single router, and configuring case or trailing-slash behavior.

Feature	Example	Description
express.Router()	`const router = express.Router()` `router.get('/', handler)`	• Creates a modular, mountable route handler • enables organizing routes into separate files for better structure.

The rest of this section is part of the full cheat sheet

Table 1: Core Application Methods

Method	Example	Description
app.listen()	`app.listen(3000, () => console.log('Server running'))`	Starts the Express application and binds it to a specified port, listening for incoming HTTP requests.
app.use()	`app.use(express.json())` `app.use('/api', routes)`	• Mounts middleware functions at a specified path • executes for every request matching that path, or globally if no path specified.
app.set()	`app.set('view engine', 'ejs')` `app.set('port', 3000)`	• Assigns a configuration setting to a name • used for application-level settings like template engine or custom properties.
app.get() (setting)	`const port = app.get('port')`	Retrieves the value of a setting previously assigned with `app.set()`.
app.locals	`app.locals.title = 'My App'`	Object containing application-level variables accessible throughout the app's lifecycle, including inside templates.
app.enable()	`app.enable('trust proxy')`	• Sets a boolean setting to `true` • enables features like proxy trust for correct IP detection behind load balancers.
app.disable()	`app.disable('x-powered-by')`	• Sets a boolean setting to `false` • commonly used to remove the `X-Powered-By` header for security.
app.param()	`app.param('id', (req, res, next, id) => { next() })`	• Adds callback triggers for route parameters • executes middleware whenever a specific named parameter is present.
app.router	`const router = app.router`	• Returns a reference to the base router instance (reintroduced in Express 5) • simplifies route management without explicit initialization.
app.path()	`app.path() // '/admin'`	• Returns the canonical path of the mounted sub-app or router • useful for debugging complex mount hierarchies.

Table 2: HTTP Route Methods

Method	Example	Description
app.get()	`app.get('/users', (req, res) => res.json(users))`	• Handles HTTP GET requests to retrieve resources • should be idempotent and safe (no side effects).

Table 3: Routing and Path Matching

Pattern	Example	Description
Route parameters	`app.get('/users/:id', (req, res) => { })` `req.params.id`	• Captures dynamic URL segments prefixed with colon • values accessible via `req.params`.

Table 4: Router for Modular Routing

Feature	Example	Description
express.Router()	`const router = express.Router()` `router.get('/', handler)`	• Creates a modular, mountable route handler • enables organizing routes into separate files for better structure.