Best Practices for Express.js Projects

⏱ Estimated reading time: 3 min

Following best practices ensures your Express.js applications are scalable, maintainable, secure, and performant.

1. Project Structure and Organization

• Organize files logically:

express-app/
│
├─ controllers/       # Business logic
├─ routes/            # Route definitions
├─ models/            # Database models
├─ middleware/        # Custom middleware
├─ config/            # Environment & config files
├─ utils/             # Utility functions
├─ app.js             # Express setup
└─ package.json

• Separating concerns makes the app modular and easy to maintain.

2. Use Environment Variables

• Store sensitive data like API keys, DB credentials, and JWT secrets outside the code.

• Use .env and dotenv:

npm install dotenv

require('dotenv').config();
const PORT = process.env.PORT || 3000;

3. Use Middleware Effectively

• Use built-in middleware:

app.use(express.json()); // Parse JSON bodies
app.use(express.urlencoded({ extended: true })); // Parse URL-encoded data

• Use third-party middleware for security, logging, and CORS:

const helmet = require('helmet');
const morgan = require('morgan');
const cors = require('cors');

app.use(helmet());
app.use(morgan('dev'));
app.use(cors());

4. Centralized Error Handling

• Use middleware for error handling:

app.use((err, req, res, next) => {
  res.status(err.status || 500).json({ message: err.message || 'Internal Server Error' });
});

• Handles errors consistently across all routes.

5. Input Validation and Sanitization

• Prevent invalid or malicious input using express-validator or similar:

npm install express-validator

const { body, validationResult } = require('express-validator');

app.post('/users',
  body('email').isEmail(),
  body('password').isLength({ min: 6 }),
  (req, res) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
    res.send('User data is valid');
  }
);

6. Security Best Practices

• Helmet → Secure headers

• HTTPS → Encrypt data in transit

• CORS → Limit domains

• Rate limiting → Prevent brute-force attacks

• Hash passwords → Using bcrypt

• Avoid exposing stack traces in production

7. Authentication & Authorization

• Use JWT or sessions for authentication

• Implement role-based access control (RBAC) for authorization:

function authorizeRole(role) {
  return (req, res, next) => {
    if (req.user.role !== role) return res.status(403).send('Forbidden');
    next();
  };
}

8. Use Express Router

• Separate routes for different resources:

const userRouter = require('./routes/users');
app.use('/users', userRouter);

• Keeps app.js clean and organized.

9. Logging

• Use morgan for HTTP request logging

• Use winston for application-level logging:

const winston = require('winston');
const logger = winston.createLogger({
  transports: [new winston.transports.Console()]
});

10. Testing

• Write unit and integration tests using:

npm install mocha chai supertest

• Example: Test API endpoints with supertest.

• Ensures code quality and prevents regressions.

11. Use Async/Await Properly

• Handle asynchronous code cleanly and catch errors:

app.get('/users', async (req, res, next) => {
  try {
    const users = await User.find();
    res.json(users);
  } catch (err) {
    next(err);
  }
});

12. Performance Optimization

• Use compression:

npm install compression

const compression = require('compression');
app.use(compression());

• Implement caching and pagination for APIs.

• Use connection pooling for databases.

13. Documentation

• Document APIs using Swagger or Postman collections.

• Makes your API easy to understand and maintain.

14. Version Control and Deployment

• Use Git for version control

• Prepare app for deployment (Render, Vercel, Heroku, etc.)

• Handle environment variables and production optimizations

15. Monitoring and Maintenance

• Use tools like PM2 or Docker for process management

• Monitor performance and logs in production

• Regularly update dependencies to patch vulnerabilities

Summary Checklist

• ✅ Modular project structure

• ✅ Environment variables for secrets

• ✅ Middleware for security, parsing, and logging

• ✅ Centralized error handling

• ✅ Input validation & sanitization

• ✅ Secure authentication & authorization

• ✅ Async/await with proper error handling

• ✅ Logging, testing, and documentation

• ✅ Performance optimization and deployment readiness