Express.js Documentation and Examples

const express = require('express');
const MyView = require('./my-view-engine');

const app = express();

// Override the default view constructor
app.set('view', MyView);

app.set('views', './views');
app.set('view engine', 'myengine');

app.get('/', (req, res) => {
  res.render('index');
});

app.listen(3000);

This is useful when integrating custom view engines or modifying the default view behavior.

Sources: History.md

In Express 3.13.0, app.configure and req.auth were deprecated. Developers should migrate to alternative patterns:

• Replace app.configure with explicit environment checks or middleware setup.
• Replace req.auth with manual parsing of the Authorization header or using the basic-auth module.

Deprecation warnings will be logged to the console when these methods are used.

Sources: History.md

Express now supports proper 205 (Reset Content) responses using res.send. This is useful for scenarios where you need to instruct the client to reset the document view.

Usage:

app.get('/reset', (req, res) => {
  res.send(205);
  // or
  res.status(205).send();
});

This feature ensures compliance with HTTP standards for 205 responses.

res.send(205);

Sources: History.md

Express 4.16.0 introduced express.json and express.urlencoded as built-in middleware for parsing request bodies. These replace the need for external body-parser package for basic JSON and URL-encoded data.

Usage:

const express = require('express');
const app = express();

// Parse JSON bodies
app.use(express.json());

// Parse URL-encoded bodies
app.use(express.urlencoded({ extended: true }));

app.post('/submit', (req, res) => {
  res.json(req.body);
});

These parsers are recommended for new applications and provide better integration with Express internals.

app.use(express.json());
app.use(express.urlencoded({ extended: true }));

Sources: History.md

Ensure your application is running on a version >= 3.5.3 to correctly parse IPv6 hosts.

const express = require('express');
const app = express();

app.get('/', (req, res) => {
  // Correctly returns [::1] or similar for IPv6
  res.send(`Host: ${req.host}`);
});

app.listen(3000);

If you are upgrading from an older version, verify that req.host returns the expected IPv6 format.

Sources: History.md

Express 4.17.0 added support for SameSite=None in cookies via the cookie dependency (v0.4.0). This is required for cookies to be sent in cross-site contexts.

Usage:

res.cookie('session', 'value', { sameSite: 'none', secure: true });

Note: When using sameSite: 'none', you must also set secure: true for the cookie to be sent in modern browsers.

res.cookie('session', 'value', { sameSite: 'none', secure: true });

Sources: History.md

Express 4.17.2 fixed handling of undefined values in res.jsonp. Previously, undefined values might have caused unexpected behavior or errors.

Usage:

app.get('/data', (req, res) => {
  res.jsonp({ value: undefined });
  // Now correctly handles undefined values
});

This ensures consistent behavior when serializing objects with undefined properties.

res.jsonp({ value: undefined });

Sources: History.md

The cookie dependency (v0.5.0) added support for the priority option in cookies. This allows you to specify the priority of the cookie (Low, Medium, High) which can affect how browsers handle cookie storage and transmission.

Usage:

res.cookie('session', 'value', { priority: 'High' });

Supported values are 'Low', 'Medium', and 'High'. This feature is useful for managing cookie precedence in complex applications.

res.cookie('session', 'value', { priority: 'High' });

Sources: History.md

The "json escape" setting can be enabled to automatically escape JSON output in res.json and res.jsonp. This is useful for preventing XSS attacks when rendering JSON in HTML contexts.

Usage:

app.set('json escape', true);

app.get('/data', (req, res) => {
  res.json({ message: '<script>alert("xss")</script>' });
  // Output will be escaped: {"message":"\u003cscript\u003e..."}
});

Enable this setting when serving JSON that might be embedded in HTML to improve security.

app.set('json escape', true);

Sources: History.md