Introduction to Arrays

Arrays are the foundation of computer programming and one of the most fundamental data structures. Understanding arrays deeply is crucial for writing efficient code and solving complex algorithmic problems.

This comprehensive guide covers everything from basic array operations to advanced techniques used in competitive programming and technical interviews.

What Are Arrays?

An array is a contiguous block of memory that stores elements of the same data type. Each element can be accessed directly using its index, making arrays one of the most efficient data structures for random access.

Key Characteristics

Fixed Size: In most languages, arrays have a fixed size at creation
Contiguous Memory: Elements are stored sequentially in memory
O(1) Access: Direct access to any element by index
Same Type: All elements must be of the same data type


Array Operations and Time Complexity



Operation
Time Complexity
Description


Access
O(1)
Direct indexing


Search
O(n)
Linear scan (unsorted)


Insert (end)
O(1)*
*Amortized for dynamic arrays


Insert (middle)
O(n)
Requires shifting elements


Delete
O(n)
Requires shifting elements



Arrays in Different Languages

Python

# Lists in Python (dynamic arrays)
numbers = [1, 2, 3, 4, 5]

# Access
print(numbers[0]) # 1

# Slicing
print(numbers[1:4]) # [2, 3, 4]

# Common operations
numbers.append(6) # Add to end
numbers.insert(0, 0) # Insert at position
numbers.pop() # Remove last
numbers.remove(3) # Remove first occurrence of value

# List comprehension
squares = [x**2 for x in range(10)]

# Array module for fixed-type arrays
from array import array
int_array = array('i', [1, 2, 3, 4, 5])

JavaScript

// Arrays in JavaScript
const numbers = [1, 2, 3, 4, 5];

// Access
console.log(numbers[0]); // 1

// Common operations
numbers.push(6); // Add to end
numbers.unshift(0); // Add to beginning
numbers.pop(); // Remove last
numbers.shift(); // Remove first

// Functional methods
const doubled = numbers.map(x => x * 2);
const evens = numbers.filter(x => x % 2 === 0);
const sum = numbers.reduce((acc, x) => acc + x, 0);

// Spread operator
const copy = [...numbers];
const merged = [...numbers, ...otherArray];

Java

// Static array
int[] numbers = new int[5];
numbers[0] = 1;

// Array initialization
int[] nums = {1, 2, 3, 4, 5};

// ArrayList (dynamic)
ArrayList list = new ArrayList();
list.add(1);
list.add(2);
list.get(0);
list.remove(0);
list.size();

// Array to ArrayList
List arrayList = Arrays.asList(1, 2, 3, 4, 5);

// Stream operations
int sum = Arrays.stream(nums).sum();
int[] doubled = Arrays.stream(nums).map(x -> x * 2).toArray();

Essential Array Algorithms

1. Two Pointer Technique

def reverse_array(arr):
"""Reverse array in-place using two pointers"""
left, right = 0, len(arr) - 1

while left < right:
arr[left], arr[right] = arr[right], arr[left]
left += 1
right -= 1

return arr

def remove_duplicates_sorted(arr):
"""Remove duplicates from sorted array"""
if not arr:
return 0

write_idx = 1

for read_idx in range(1, len(arr)):
if arr[read_idx] != arr[read_idx - 1]:
arr[write_idx] = arr[read_idx]
write_idx += 1

return write_idx # New length

2. Sliding Window

def max_sum_subarray(arr, k):
"""Find maximum sum of k consecutive elements"""
if len(arr) < k:
return None

# Calculate sum of first window
window_sum = sum(arr[:k])
max_sum = window_sum

# Slide the window
for i in range(k, len(arr)):
window_sum = window_sum - arr[i - k] + arr[i]
max_sum = max(max_sum, window_sum)

return max_sum

def longest_substring_k_distinct(s, k):
"""Find longest substring with at most k distinct characters"""
char_count = {}
left = 0
max_length = 0

for right in range(len(s)):
char_count[s[right]] = char_count.get(s[right], 0) + 1

while len(char_count) > k:
char_count[s[left]] -= 1
if char_count[s[left]] == 0:
del char_count[s[left]]
left += 1

max_length = max(max_length, right - left + 1)

return max_length

3. Kadane's Algorithm (Maximum Subarray)

def max_subarray_sum(arr):
"""Find maximum sum of contiguous subarray"""
max_current = max_global = arr[0]

for i in range(1, len(arr)):
max_current = max(arr[i], max_current + arr[i])
max_global = max(max_global, max_current)

return max_global

# With indices
def max_subarray_with_indices(arr):
"""Return max sum and indices of subarray"""
max_current = arr[0]
max_global = arr[0]
start = end = s = 0

for i in range(1, len(arr)):
if arr[i] > max_current + arr[i]:
max_current = arr[i]
s = i
else:
max_current = max_current + arr[i]

if max_current > max_global:
max_global = max_current
start = s
end = i

return max_global, start, end

4. Binary Search

def binary_search(arr, target):
"""Binary search in sorted array"""
left, right = 0, len(arr) - 1

while left

The Problem with Passwords

Passwords have been the cornerstone of digital security for decades, but they're fundamentally broken. Users create weak passwords, reuse them across services, and fall victim to phishing attacks. It's time for a revolution.

This guide explores passwordless authentication methods that are more secure, more convenient, and ready for production deployment.

Why Passwordless?

Security Benefits

No Password Leaks: Nothing to steal from databases
Phishing Resistant: No credentials to phish
No Weak Passwords: Eliminates human error
No Reuse: Each authentication is unique


User Experience Benefits

Faster login process
No forgotten password hassles
Less friction for users
Better mobile experience


Passwordless Authentication Methods

1. Magic Links (Email-based)

Send a unique, time-limited link to user's email. Simple and effective.

// Node.js + Express implementation
const crypto = require('crypto');
const jwt = require('jsonwebtoken');

async function sendMagicLink(email) {
// Generate secure token
const token = jwt.sign(
{ email, type: 'magic_link' },
process.env.JWT_SECRET,
{ expiresIn: '15m' }
);

const magicLink = `https://yourapp.com/auth/verify?token=${token}`;

// Send email
await sendEmail({
to: email,
subject: 'Your Login Link',
html: `
Welcome back!
Click the link below to sign in:
Sign In
This link expires in 15 minutes.
`
});
}

async function verifyMagicLink(token) {
try {
const decoded = jwt.verify(token, process.env.JWT_SECRET);

if (decoded.type !== 'magic_link') {
throw new Error('Invalid token type');
}

// Create session
const sessionToken = jwt.sign(
{ email: decoded.email },
process.env.JWT_SECRET,
{ expiresIn: '7d' }
);

return { success: true, sessionToken };
} catch (error) {
return { success: false, error: error.message };
}
}

// Express routes
app.post('/auth/send-link', async (req, res) => {
const { email } = req.body;

// Validate email
if (!isValidEmail(email)) {
return res.status(400).json({ error: 'Invalid email' });
}

await sendMagicLink(email);
res.json({ message: 'Magic link sent' });
});

app.get('/auth/verify', async (req, res) => {
const { token } = req.query;
const result = await verifyMagicLink(token);

if (result.success) {
res.cookie('session', result.sessionToken, {
httpOnly: true,
secure: true,
sameSite: 'strict',
maxAge: 7 * 24 * 60 * 60 * 1000
});
res.redirect('/dashboard');
} else {
res.status(400).json({ error: result.error });
}
});

2. One-Time Passwords (OTP)

Send a code via SMS or email. Great for mobile-first applications.

import random
import time
from datetime import datetime, timedelta

class OTPService:
def __init__(self):
self.otp_storage = {} # Use Redis in production

def generate_otp(self, identifier, length=6):
"""Generate a random OTP"""
otp = ''.join([str(random.randint(0, 9)) for _ in range(length)])

# Store with expiration
self.otp_storage[identifier] = {
'code': otp,
'expires_at': datetime.now() + timedelta(minutes=5),
'attempts': 0
}

return otp

def verify_otp(self, identifier, code):
"""Verify OTP code"""
stored = self.otp_storage.get(identifier)

if not stored:
return False, 'OTP not found'

# Check expiration
if datetime.now() > stored['expires_at']:
del self.otp_storage[identifier]
return False, 'OTP expired'

# Rate limiting
if stored['attempts'] >= 3:
del self.otp_storage[identifier]
return False, 'Too many attempts'

stored['attempts'] += 1

# Verify code
if stored['code'] == code:
del self.otp_storage[identifier]
return True, 'Success'

return False, 'Invalid code'

def send_sms_otp(self, phone_number):
"""Send OTP via SMS"""
otp = self.generate_otp(phone_number)

# Use Twilio, AWS SNS, or similar
send_sms(phone_number, f'Your verification code is: {otp}')

return True

# FastAPI implementation
from fastapi import FastAPI, HTTPException
from pydantic import BaseModel

app = FastAPI()
otp_service = OTPService()

class OTPRequest(BaseModel):
phone: str

class OTPVerify(BaseModel):
phone: str
code: str

@app.post('/auth/send-otp')
async def send_otp(request: OTPRequest):
otp_service.send_sms_otp(request.phone)
return {'message': 'OTP sent'}

@app.post('/auth/verify-otp')
async def verify_otp(request: OTPVerify):
success, message = otp_service.verify_otp(request.phone, request.code)

if not success:
raise HTTPException(status_code=400, detail=message)

# Create session
token = create_session_token(request.phone)
return {'token': token}

3. WebAuthn / FIDO2 (Biometric & Hardware Keys)

The gold standard for passwordless authentication using device biometrics or hardware security keys.

// Frontend - Registration
import { startRegistration } from '@simplewebauthn/browser';

async function registerWebAuthn() {
try {
// Get registration options from server
const optionsResponse = await fetch('/auth/register/options', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ email: userEmail })
});

const options = await optionsResponse.json();

// Start browser registration
const credential = await startRegistration(options);

// Send credential to server
const verifyResponse = await fetch('/auth/register/verify', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
email: userEmail,
credential
})
});

if (verifyResponse.ok) {
alert('Registration successful!');
}
} catch (error) {
console.error('Registration failed:', error);
}
}

// Frontend - Authentication
import { startAuthentication } from '@simplewebauthn/browser';

async function loginWithWebAuthn() {
try {
// Get authentication options
const optionsResponse = await fetch('/auth/login/options', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ email: userEmail })
});

const options = await optionsResponse.json();

// Start browser authentication
const credential = await startAuthentication(options);

// Verify with server
const verifyResponse = await fetch('/auth/login/verify', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
email: userEmail,
credential
})
});

if (verifyResponse.ok) {
const { token } = await verifyResponse.json();
localStorage.setItem('authToken', token);
window.location.href = '/dashboard';
}
} catch (error) {
console.error('Login failed:', error);
}
}

// Backend - Node.js with @simplewebauthn/server
const {
generateRegistrationOptions,
verifyRegistrationResponse,
generateAuthenticationOptions,
verifyAuthenticationResponse,
} = require('@simplewebauthn/server');

const rpName = 'Your App Name';
const rpID = 'yourapp.com';
const origin = 'https://yourapp.com';

// Registration
app.post('/auth/register/options', async (req, res) => {
const { email } = req.body;

const user = await findOrCreateUser(email);

const options = await generateRegistrationOptions({
rpName,
rpID,
userID: user.id,
userName: email,
attestationType: 'none',
authenticatorSelection: {
residentKey: 'preferred',
userVerification: 'preferred',
},
});

// Store challenge in session/redis
await storeChallenge(user.id, options.challenge);

res.json(options);
});

app.post('/auth/register/verify', async (req, res) => {
const { email, credential } = req.body;

const user = await getUserByEmail(email);
const expectedChallenge = await getChallenge(user.id);

try {
const verification = await verifyRegistrationResponse({
response: credential,
expectedChallenge,
expectedOrigin: origin,
expectedRPID: rpID,
});

if (verification.verified) {
// Save credential to database
await saveCredential(user.id, {
credentialID: verification.registrationInfo.credentialID,
credentialPublicKey: verification.registrationInfo.credentialPublicKey,
counter: verification.registrationInfo.counter,
});

res.json({ verified: true });
}
} catch (error) {
res.status(400).json({ error: error.message });
}
});

// Authentication
app.post('/auth/login/options', async (req, res) => {
const { email } = req.body;

const user = await getUserByEmail(email);
const credentials = await getUserCredentials(user.id);

const options = await generateAuthenticationOptions({
rpID,
allowCredentials: credentials.map(cred => ({
id: cred.credentialID,
type: 'public-key',
transports: ['usb', 'ble', 'nfc', 'internal'],
})),
userVerification: 'preferred',
});

await storeChallenge(user.id, options.challenge);

res.json(options);
});

app.post('/auth/login/verify', async (req, res) => {
const { email, credential } = req.body;

const user = await getUserByEmail(email);
const expectedChallenge = await getChallenge(user.id);
const dbCredential = await getCredentialById(credential.id);

try {
const verification = await verifyAuthenticationResponse({
response: credential,
expectedChallenge,
expectedOrigin: origin,
expectedRPID: rpID,
authenticator: {
credentialID: dbCredential.credentialID,
credentialPublicKey: dbCredential.credentialPublicKey,
counter: dbCredential.counter,
},
});

if (verification.verified) {
// Update counter
await updateCredentialCounter(
credential.id,
verification.authenticationInfo.newCounter
);

// Create session
const token = createSessionToken(user.id);

res.json({ verified: true, token });
}
} catch (error) {
res.status(400).json({ error: error.message });
}
});

4. Social Login (OAuth)

Delegate authentication to trusted providers like Google, GitHub, or Facebook.

// Using Passport.js
const passport = require('passport');
const GoogleStrategy = require('passport-google-oauth20').Strategy;

passport.use(new GoogleStrategy({
clientID: process.env.GOOGLE_CLIENT_ID,
clientSecret: process.env.GOOGLE_CLIENT_SECRET,
callbackURL: '/auth/google/callback'
},
async (accessToken, refreshToken, profile, done) => {
try {
// Find or create user
let user = await User.findOne({ googleId: profile.id });

if (!user) {
user = await User.create({
googleId: profile.id,
email: profile.emails[0].value,
name: profile.displayName,
avatar: profile.photos[0].value
});
}

return done(null, user);
} catch (error) {
return done(error, null);
}
}
));

// Routes
app.get('/auth/google',
passport.authenticate('google', { scope: ['profile', 'email'] })
);

app.get('/auth/google/callback',
passport.authenticate('google', { failureRedirect: '/login' }),
(req, res) => {
// Create session
const token = createSessionToken(req.user.id);
res.cookie('session', token, { httpOnly: true, secure: true });
res.redirect('/dashboard');
}
);

Best Practices for Passwordless Authentication

1. Security Considerations

// Rate limiting
const rateLimit = require('express-rate-limit');

const authLimiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 5, // 5 attempts
message: 'Too many authentication attempts'
});

app.post('/auth/send-link', authLimiter, handleMagicLink);

// Token expiration
const TOKEN_EXPIRY = {
magicLink: '15m',
otp: '5m',
session: '7d'
};

// Secure token generation
function generateSecureToken() {
return crypto.randomBytes(32).toString('hex');
}

2. Fallback Methods

Always provide multiple authentication options:

const AUTH_METHODS = {
magicLink: { enabled: true, primary: true },
otp: { enabled: true, primary: false },
webauthn: { enabled: true, primary: false },
social: { enabled: true, providers: ['google', 'github'] }
};

3. Session Management

// Secure session handling
const session = require('express-session');
const RedisStore = require('connect-redis')(session);

app.use(session({
store: new RedisStore({ client: redisClient }),
secret: process.env.SESSION_SECRET,
resave: false,
saveUninitialized: false,
cookie: {
secure: true,
httpOnly: true,
maxAge: 7 * 24 * 60 * 60 * 1000,
sameSite: 'strict'
}
}));

Migration Strategy

From Passwords to Passwordless

// Gradual migration approach
async function handleLogin(email, password = null) {
const user = await getUserByEmail(email);

// User has password
if (user.hasPassword) {
if (password && await bcrypt.compare(password, user.passwordHash)) {
// Offer passwordless setup
return {
success: true,
suggestPasswordless: true
};
}
}

// Passwordless flow
if (user.passwordlessEnabled) {
await sendMagicLink(email);
return {
success: true,
method: 'magic_link'
};
}
}

Testing Passwordless Authentication

// Jest tests
describe('Magic Link Authentication', () => {
test('should generate and verify magic link', async () => {
const email = 'test@example.com';

// Generate link
await sendMagicLink(email);

// Get token from email mock
const token = getLastEmailToken();

// Verify token
const result = await verifyMagicLink(token);

expect(result.success).toBe(true);
expect(result.sessionToken).toBeDefined();
});

test('should reject expired token', async () => {
const expiredToken = generateExpiredToken();
const result = await verifyMagicLink(expiredToken);

expect(result.success).toBe(false);
expect(result.error).toContain('expired');
});
});

Monitoring and Analytics

// Track authentication metrics
const metrics = {
track(event, data) {
console.log(`Auth Event: ${event}`, data);
// Send to analytics service
}
};

// Usage
metrics.track('magic_link_sent', { email });
metrics.track('magic_link_verified', { email, timeToVerify });
metrics.track('webauthn_registered', { userId, deviceType });

Real-World Implementation Examples

Companies Using Passwordless

Slack: Magic links
Medium: Email-based authentication
Auth0: Multiple passwordless methods
Microsoft: Windows Hello, FIDO2
Google: 2FA with phone prompts


Conclusion

Passwordless authentication is not just a trend—it's the future of secure, user-friendly authentication. Whether you start with simple magic links or implement full WebAuthn support, your users will thank you for removing the password burden.

Start small, measure adoption, and gradually expand your passwordless offerings. Security and user experience don't have to be at odds.

Understanding Express.js Middleware

Middleware functions are the backbone of Express.js applications. They have access to the request object (req), response object (res), and the next middleware function in the application's request-response cycle.

This comprehensive guide covers everything from basic middleware concepts to production-ready patterns used by companies at scale.

Middleware Fundamentals

Basic Middleware Structure

// Simple middleware function
function myMiddleware(req, res, next) {
// Do something with req/res
console.log('Request received:', req.method, req.url);

// Pass control to next middleware
next();
}

// Use middleware
app.use(myMiddleware);

Types of Middleware


Application-level middleware: Bound to app instance
Router-level middleware: Bound to router instance
Error-handling middleware: Has 4 parameters (err, req, res, next)
Built-in middleware: express.json(), express.static()
Third-party middleware: helmet, cors, morgan


Essential Production Middleware

1. Security Middleware

const helmet = require('helmet');
const cors = require('cors');
const rateLimit = require('express-rate-limit');

// Helmet - Security headers
app.use(helmet({
contentSecurityPolicy: {
directives: {
defaultSrc: ["'self'"],
styleSrc: ["'self'", "'unsafe-inline'"],
scriptSrc: ["'self'"],
imgSrc: ["'self'", 'data:', 'https:']
}
},
hsts: {
maxAge: 31536000,
includeSubDomains: true,
preload: true
}
}));

// CORS configuration
const corsOptions = {
origin: function (origin, callback) {
const whitelist = process.env.ALLOWED_ORIGINS.split(',');
if (whitelist.indexOf(origin) !== -1 || !origin) {
callback(null, true);
} else {
callback(new Error('Not allowed by CORS'));
}
},
credentials: true,
optionsSuccessStatus: 200
};
app.use(cors(corsOptions));

// Rate limiting
const limiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100, // limit each IP to 100 requests per windowMs
message: 'Too many requests from this IP',
standardHeaders: true,
legacyHeaders: false,
});
app.use('/api/', limiter);

// Stricter rate limit for auth endpoints
const authLimiter = rateLimit({
windowMs: 15 * 60 * 1000,
max: 5,
skipSuccessfulRequests: true
});
app.use('/api/auth/', authLimiter);

2. Request Parsing Middleware

const express = require('express');
const compression = require('compression');

// Body parsers
app.use(express.json({
limit: '10mb',
verify: (req, res, buf) => {
req.rawBody = buf;
}
}));

app.use(express.urlencoded({
extended: true,
limit: '10mb'
}));

// Compression
app.use(compression({
filter: (req, res) => {
if (req.headers['x-no-compression']) {
return false;
}
return compression.filter(req, res);
},
level: 6
}));

3. Logging Middleware

const morgan = require('morgan');
const winston = require('winston');
const fs = require('fs');
const path = require('path');

// Winston logger setup
const logger = winston.createLogger({
level: 'info',
format: winston.format.combine(
winston.format.timestamp(),
winston.format.json()
),
transports: [
new winston.transports.File({
filename: 'logs/error.log',
level: 'error'
}),
new winston.transports.File({
filename: 'logs/combined.log'
})
]
});

if (process.env.NODE_ENV !== 'production') {
logger.add(new winston.transports.Console({
format: winston.format.simple()
}));
}

// Morgan HTTP request logging
const accessLogStream = fs.createWriteStream(
path.join(__dirname, 'logs', 'access.log'),
{ flags: 'a' }
);

app.use(morgan('combined', { stream: accessLogStream }));

// Custom request logger
app.use((req, res, next) => {
const start = Date.now();

res.on('finish', () => {
const duration = Date.now() - start;
logger.info({
method: req.method,
url: req.url,
status: res.statusCode,
duration: `${duration}ms`,
ip: req.ip,
userAgent: req.get('user-agent')
});
});

next();
});

4. Authentication Middleware

const jwt = require('jsonwebtoken');

// JWT authentication
function authenticateToken(req, res, next) {
const authHeader = req.headers['authorization'];
const token = authHeader && authHeader.split(' ')[1];

if (!token) {
return res.status(401).json({ error: 'No token provided' });
}

jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
if (err) {
return res.status(403).json({ error: 'Invalid token' });
}

req.user = user;
next();
});
}

// Optional authentication
function optionalAuth(req, res, next) {
const authHeader = req.headers['authorization'];
const token = authHeader && authHeader.split(' ')[1];

if (token) {
jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
if (!err) {
req.user = user;
}
});
}

next();
}

// Role-based authorization
function requireRole(...roles) {
return (req, res, next) => {
if (!req.user) {
return res.status(401).json({ error: 'Not authenticated' });
}

if (!roles.includes(req.user.role)) {
return res.status(403).json({ error: 'Insufficient permissions' });
}

next();
};
}

// Usage
app.get('/api/protected', authenticateToken, (req, res) => {
res.json({ data: 'Protected data', user: req.user });
});

app.get('/api/admin', authenticateToken, requireRole('admin'), (req, res) => {
res.json({ data: 'Admin data' });
});

5. Validation Middleware

const { body, param, query, validationResult } = require('express-validator');

// Validation middleware factory
function validate(validations) {
return async (req, res, next) => {
await Promise.all(validations.map(validation => validation.run(req)));

const errors = validationResult(req);
if (!errors.isEmpty()) {
return res.status(400).json({
errors: errors.array().map(err => ({
field: err.param,
message: err.msg
}))
});
}

next();
};
}

// Example validations
const userValidation = validate([
body('email').isEmail().normalizeEmail(),
body('password').isLength({ min: 8 })
.matches(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)/)
.withMessage('Password must contain uppercase, lowercase, and number'),
body('age').optional().isInt({ min: 18, max: 120 })
]);

const idValidation = validate([
param('id').isMongoId()
]);

// Usage
app.post('/api/users', userValidation, createUser);
app.get('/api/users/:id', idValidation, getUser);

6. Error Handling Middleware

// Custom error class
class AppError extends Error {
constructor(message, statusCode) {
super(message);
this.statusCode = statusCode;
this.isOperational = true;
Error.captureStackTrace(this, this.constructor);
}
}

// Async wrapper to catch errors
function asyncHandler(fn) {
return (req, res, next) => {
Promise.resolve(fn(req, res, next)).catch(next);
};
}

// 404 handler
app.use((req, res, next) => {
next(new AppError(`Cannot find ${req.originalUrl}`, 404));
});

// Global error handler
app.use((err, req, res, next) => {
err.statusCode = err.statusCode || 500;
err.status = err.status || 'error';

// Log error
logger.error({
message: err.message,
stack: err.stack,
url: req.url,
method: req.method
});

// Development error response
if (process.env.NODE_ENV === 'development') {
return res.status(err.statusCode).json({
status: err.status,
error: err,
message: err.message,
stack: err.stack
});
}

// Production error response
if (err.isOperational) {
return res.status(err.statusCode).json({
status: err.status,
message: err.message
});
}

// Programming or unknown errors
return res.status(500).json({
status: 'error',
message: 'Something went wrong'
});
});

// Usage
app.get('/api/users/:id', asyncHandler(async (req, res) => {
const user = await User.findById(req.params.id);

if (!user) {
throw new AppError('User not found', 404);
}

res.json({ user });
}));

Advanced Middleware Patterns

1. Caching Middleware

const redis = require('redis');
const client = redis.createClient();

function cache(duration) {
return async (req, res, next) => {
if (req.method !== 'GET') {
return next();
}

const key = `cache:${req.originalUrl}`;

try {
const cachedResponse = await client.get(key);

if (cachedResponse) {
return res.json(JSON.parse(cachedResponse));
}

// Override res.json to cache response
const originalJson = res.json.bind(res);
res.json = (body) => {
client.setex(key, duration, JSON.stringify(body));
return originalJson(body);
};

next();
} catch (error) {
next(error);
}
};
}

// Usage
app.get('/api/products', cache(300), getProducts);

2. Request Context Middleware

const { v4: uuidv4 } = require('uuid');
const cls = require('cls-hooked');

const namespace = cls.createNamespace('request-context');

function requestContext(req, res, next) {
namespace.run(() => {
const requestId = uuidv4();
namespace.set('requestId', requestId);
namespace.set('userId', req.user?.id);

res.setHeader('X-Request-ID', requestId);

next();
});
}

// Helper to get context anywhere
function getRequestContext() {
return {
requestId: namespace.get('requestId'),
userId: namespace.get('userId')
};
}

app.use(requestContext);

3. API Versioning Middleware

function apiVersion(version) {
return (req, res, next) => {
req.apiVersion = version;
next();
};
}

// V1 routes
const v1Router = express.Router();
v1Router.use(apiVersion('v1'));
v1Router.get('/users', getUsersV1);

// V2 routes
const v2Router = express.Router();
v2Router.use(apiVersion('v2'));
v2Router.get('/users', getUsersV2);

app.use('/api/v1', v1Router);
app.use('/api/v2', v2Router);

4. Performance Monitoring

const prometheus = require('prom-client');

// Metrics
const httpRequestDuration = new prometheus.Histogram({
name: 'http_request_duration_seconds',
help: 'Duration of HTTP requests in seconds',
labelNames: ['method', 'route', 'status_code']
});

const httpRequestTotal = new prometheus.Counter({
name: 'http_requests_total',
help: 'Total number of HTTP requests',
labelNames: ['method', 'route', 'status_code']
});

function metricsMiddleware(req, res, next) {
const start = process.hrtime();

res.on('finish', () => {
const duration = process.hrtime(start);
const durationSeconds = duration[0] + duration[1] / 1e9;

const route = req.route?.path || req.path;

httpRequestDuration
.labels(req.method, route, res.statusCode)
.observe(durationSeconds);

httpRequestTotal
.labels(req.method, route, res.statusCode)
.inc();
});

next();
}

app.use(metricsMiddleware);

// Metrics endpoint
app.get('/metrics', async (req, res) => {
res.set('Content-Type', prometheus.register.contentType);
res.end(await prometheus.register.metrics());
});

Middleware Execution Order

const express = require('express');
const app = express();

// 1. Security (first)
app.use(helmet());
app.use(cors(corsOptions));
app.use(limiter);

// 2. Request parsing
app.use(express.json());
app.use(express.urlencoded({ extended: true }));
app.use(compression());

// 3. Logging and monitoring
app.use(morgan('combined'));
app.use(metricsMiddleware);
app.use(requestContext);

// 4. Static files
app.use(express.static('public'));

// 5. Authentication (if needed globally)
app.use(optionalAuth);

// 6. Routes
app.use('/api/v1', v1Router);
app.use('/api/v2', v2Router);

// 7. 404 handler
app.use(notFoundHandler);

// 8. Error handler (last)
app.use(errorHandler);

Testing Middleware

const request = require('supertest');
const express = require('express');

describe('Authentication Middleware', () => {
let app;

beforeEach(() => {
app = express();
app.use(express.json());
app.get('/protected', authenticateToken, (req, res) => {
res.json({ user: req.user });
});
});

test('should reject request without token', async () => {
const response = await request(app)
.get('/protected');

expect(response.status).toBe(401);
});

test('should accept valid token', async () => {
const token = generateTestToken({ id: 1, email: 'test@example.com' });

const response = await request(app)
.get('/protected')
.set('Authorization', `Bearer ${token}`);

expect(response.status).toBe(200);
expect(response.body.user).toBeDefined();
});
});

Performance Best Practices


Order matters: Put frequently used middleware first
Avoid heavy computation: Keep middleware fast
Use async/await properly: Prevent blocking
Cache when possible: Reduce redundant work
Monitor performance: Track middleware execution time


Production Checklist


✅ Security headers configured (helmet)
✅ Rate limiting implemented
✅ CORS properly configured
✅ Request validation in place
✅ Error handling comprehensive
✅ Logging configured
✅ Authentication/authorization working
✅ Monitoring and metrics enabled
✅ Compression enabled
✅ Tests written for middleware


Conclusion

Mastering Express.js middleware is essential for building production-ready Node.js applications. From security to performance monitoring, middleware provides the foundation for scalable, maintainable applications.

Start with the basics, add security layers, implement proper error handling, and monitor everything. Your production application will thank you.