Node.js In-Depth
Module F-6·17 min read

The built-in http module, why Express exists, routing, middleware pipelines, route parameters, query strings, and sending JSON responses.

Written by Jatin Jain Saraf · Architect of SupraScan

Module F-6 — Building HTTP Servers and REST APIs with Express

What this module covers: Express is the most widely used Node.js web framework — and for good reason. It takes the built-in http module and adds routing, middleware, and a clean request/response API without imposing a rigid structure. This module covers everything you need to build a real REST API: routing, route parameters, query strings, request bodies, middleware pipelines, and error responses. By the end you will have a working multi-route API with proper HTTP semantics.

From Raw http to Express

You saw the built-in http module in F-1:

const http = require('node:http');
 
const server = http.createServer((req, res) => {
  res.writeHead(200, { 'Content-Type': 'text/plain' });
  res.end('Hello World\n');
});
 
server.listen(3000);

This works, but it has no routing. Every request — regardless of URL or method — hits the same handler. To build a real API you need to route GET /users to one handler, POST /users to another, DELETE /users/:id to a third. You also need to parse JSON bodies, read headers, set response codes properly, and handle errors consistently.

You could implement all of that yourself on top of http. Express already did it — and did it well.

npm install express

Version note: you're likely installing Express 5. npm install express has pulled Express 5.x since September 2024 — that's the latest tag now, not Express 4. This module's code works the same under both versions, but two differences are worth flagging up front so the rest of the module doesn't silently assume Express 4 behavior:

  • Async error forwarding. In Express 5, if an async route handler's promise rejects, Express automatically forwards that rejection to your error-handling middleware. You don't strictly need the manual try { ... } catch (err) { next(err) } pattern shown in the Error Handling section below — though it's still fine practice, and it is required if you're on Express 4 (still extremely common in existing production codebases). The Error Handling section explains why that pattern exists in the first place.
  • Stricter routing. Express 5 ships a new router (path-to-regexp v8) that rejects some Express 4-era path patterns — most notably bare wildcards like app.get('*', ...), which now throw at startup. Use a named wildcard like app.get('/*splat', ...) instead.

Run npm ls express if you're ever unsure which version a project is actually running.

Your First Express Server

// src/index.js
import express from 'express';
 
const app = express();
const PORT = process.env.PORT || 3000;
 
// Middleware: parse incoming JSON bodies
app.use(express.json());
 
// Route: GET /
app.get('/', (req, res) => {
  res.json({ message: 'Hello from Express!' });
});
 
// Start listening
app.listen(PORT, () => {
  console.log(`Server running on http://localhost:${PORT}`);
});
node src/index.js
curl http://localhost:3000/
# {"message":"Hello from Express!"}

The Express API:

  • express() creates an application instance
  • app.use(...) adds middleware (runs on every request)
  • app.get(path, handler) registers a GET route
  • req — the incoming request object
  • res — the response object
  • res.json(data) — sends JSON with Content-Type: application/json and status 200

HTTP Methods and REST Conventions

REST APIs use HTTP methods to express intent:

MethodMeaningExample
GETRead a resourceGET /users — list all users
POSTCreate a resourcePOST /users — create a user
PUTReplace a resource entirelyPUT /users/42 — replace user 42
PATCHUpdate part of a resourcePATCH /users/42 — update user 42's email
DELETERemove a resourceDELETE /users/42 — delete user 42

Express has a method for each:

app.get('/users', (req, res) => { /* list users */ });
app.post('/users', (req, res) => { /* create user */ });
app.put('/users/:id', (req, res) => { /* replace user */ });
app.patch('/users/:id', (req, res) => { /* update user */ });
app.delete('/users/:id', (req, res) => { /* delete user */ });

Route Parameters

Route parameters are named placeholders in the URL path, prefixed with :. Express captures them and puts them in req.params.

// :id is a route parameter
app.get('/users/:id', (req, res) => {
  const { id } = req.params;  // e.g. '42' (always a string)
  res.json({ userId: id });
});
 
// Multiple parameters
app.get('/users/:userId/posts/:postId', (req, res) => {
  const { userId, postId } = req.params;
  res.json({ userId, postId });
});
curl http://localhost:3000/users/42
# {"userId":"42"}
 
curl http://localhost:3000/users/42/posts/7
# {"userId":"42","postId":"7"}

Important: route parameters are always strings, even if the URL contains a number. Convert them explicitly:

app.get('/users/:id', async (req, res) => {
  const id = parseInt(req.params.id, 10);
 
  if (isNaN(id)) {
    return res.status(400).json({ error: 'id must be a number' });
  }
 
  const user = await db.findUser(id);
  if (!user) {
    return res.status(404).json({ error: 'User not found' });
  }
 
  res.json(user);
});

Query Strings

Query strings are the ?key=value part of a URL. Express parses them automatically into req.query.

// GET /users?role=admin&active=true&page=2&limit=20
app.get('/users', async (req, res) => {
  const {
    role,
    active,
    page = '1',
    limit = '20'
  } = req.query;
 
  const pageNum = parseInt(page, 10);
  const limitNum = parseInt(limit, 10);
  const isActive = active === 'true';
 
  const users = await db.findUsers({ role, active: isActive, pageNum, limitNum });
  res.json(users);
});
curl "http://localhost:3000/users?role=admin&active=true&page=1&limit=10"

Query string values are always strings — convert them as needed.

Request Bodies

For POST, PUT, and PATCH requests, data comes in the request body. With express.json() middleware registered, Express automatically parses JSON bodies into req.body.

// Middleware registered once at the top — applies to all routes
app.use(express.json());
 
// POST /users — create a new user
app.post('/users', async (req, res) => {
  const { name, email, role } = req.body;
 
  // Basic validation
  if (!name || !email) {
    return res.status(400).json({ error: 'name and email are required' });
  }
 
  const newUser = await db.createUser({ name, email, role: role || 'user' });
  res.status(201).json(newUser);  // 201 Created
});
curl -X POST http://localhost:3000/users \
  -H "Content-Type: application/json" \
  -d '{"name": "Jatin", "email": "jatin@example.com"}'
 
# {"id": 1, "name": "Jatin", "email": "jatin@example.com", "role": "user"}

Sign in to keep reading

The rest of this module is free — sign in with Google to unlock it and track your progress.

Sign in & Register
PreviousModule F-5: npm and the Node.js EcosystemNext Module F-7: Working with Databases from Node.js

Discussion

0

Join the discussion

Loading comments...
PortfolioBlog

© 2026 Jatin Jain Saraf (JJS). All rights reserved.