expressjs_skill

Overview

This skill provides concise, practical documentation and guidance for using Express.js (versions 3.x–5.x). It consolidates core API usage, routing, middleware patterns, production best practices, and migration notes for 2024–2025 security updates. Use it to get clear, actionable answers for building and hardening Node.js web apps with Express.

How this skill works

The skill inspects Express API surface, routing and middleware conventions, error handling, request/response utilities, and deployment recommendations. It references security advisories and migration guidance across versions 3, 4, and 5, plus language-specific translations and best-practice sections for production readiness. Answers synthesize examples, configuration tips, and vulnerability mitigations from official docs and release notes.

When to use it

• You need examples for routing, middleware, or error handlers in Express.
• You are migrating an app between Express major versions (3→4 or 4→5).
• You want production best practices for performance, reliability, or proxy configuration.
• You need to address known vulnerabilities or apply security updates for 2024–2025.
• You need language-specific guidance (de, en, es, fr) or translated documentation references.

Best practices

• Use modular routers and middleware functions to keep routes composable and testable.
• Handle errors with centralized error-handling middleware; avoid leaking stack traces in production.
• Validate and sanitize inputs early (use body parsing and validation middleware) to reduce attack surface.
• Configure trust proxy correctly when behind load balancers; set secure cookie and HSTS policies.
• Keep dependencies updated and review security advisories for Express and common middleware (body-parser, cookie, basic-auth-connect).

Example use cases

• Create a REST API with express.Router(), route parameters, and JSON request parsing.
• Add authentication and session handling using cookie/session middleware with secure cookie options.
• Migrate existing Express 4.x code to Express 5 using documented codemods and handle removed APIs.
• Deploy Express behind a reverse proxy with correct trust proxy and logging for client IPs.
• Implement global error handling that returns sanitized responses and logs internal errors.