r/expressjs • u/Crescitaly • Mar 03 '26
After 2 years of Express.js in production, here are the middleware patterns that saved me and the ones I regret.
Running Express.js serving 15K users on a solo project. After 2 years of production firefighting, here's what actually worked vs what wasted my time:
Patterns that saved me:
1. Async error wrapper (eliminated 90% of unhandled rejections)
const asyncHandler = (fn) => (req, res, next) =>
Promise.resolve(fn(req, res, next)).catch(next);Every route handler wrapped in this. No more try/catch blocks everywhere. Errors flow to the centralized error handler automatically.
2. Request correlation IDs
app.use((req, res, next) => {
req.id = req.headers['x-request-id'] || crypto.randomUUID();
next();
});Attached to every log entry. When a user reports an issue, I search by their request ID and get the full picture in seconds.
3. Rate limiting per route, not globally Different endpoints have different limits. Login attempts: 5/min. API reads: 100/min. Webhooks: 500/min. Global rate limiting was either too strict for normal use or too loose for sensitive endpoints.
4. Graceful shutdown middleware On SIGTERM, stop accepting new connections, wait for in-flight requests to finish (with a 30s timeout), then close DB pools. Without this, every deploy caused dropped requests.
5. Response time header
app.use((req, res, next) => {
const start = process.hrtime.bigint();
res.on('finish', () => {
const ms = Number(process.hrtime.bigint() - start) / 1e6;
logger.info({ requestId: req.id, method: req.method, path: req.path, status: res.statusCode, ms });
});
next();
});Every request logged with exact timing. Found 3 endpoints that were secretly taking 2s+ that I never would've caught otherwise.
Patterns I abandoned:
Complex validation middleware chains — Switched to Joi/Zod at the route level. Easier to read, easier to test.
Custom auth middleware per route — Moved to a single auth middleware with role-based config. Less code, fewer bugs.
Helmet with default config — Half the headers were breaking my frontend. Now I configure each header explicitly.
Morgan for logging — Replaced with pino. Morgan doesn't support structured JSON logging well, and structured logs are non-negotiable in production.
What Express patterns do you swear by? Anything you'd add to the "abandon" list?
