Installs into .claude/skills of the current project.
Are you the author of Express Middleware?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/black141312-express-middleware)
---
name: express-middleware
description: Add Express middleware for auth, logging, or error handling in the right order
category: frameworks
---
# Express Middleware
Use to add cross-cutting behavior (authentication, request logging, error handling) to an Express app via middleware, registered in the correct order.
1. Decide the type: request middleware `(req, res, next)` for logging/auth, or error middleware `(err, req, res, next)` (four args) for errors.
2. Write it in its own module; do work, attach to `req` (e.g. `req.user`), then call `next()` — or `next(err)` to fail.
3. Register globally with `app.use(fn)` or per-route with `router.get(path, mw, handler)`; order matters — earlier `use` runs first.
4. For auth, validate the token/session, reject with `401`/`403` (don't call `next()`), or set `req.user` and continue.
5. Mount error-handling middleware last, after all routes, so thrown/`next(err)` errors funnel into one place.
6. Run the server and verify: logs appear, protected routes reject without creds, and errors return clean JSON not stack traces.
## Rules
- Always call `next()` (or send a response) — forgetting it hangs the request.
- Error middleware MUST have four parameters or Express treats it as normal middleware.
- Register body parsers and loggers before routes; register the error handler after them.
- In async middleware, wrap or `try/catch` and pass errors to `next(err)` — thrown async errors aren't auto-caught (pre-Express 5).
- Don't leak internals: log the full error server-side, return a sanitized message/status to the client.
