# Express

> Express.js server best practices including middleware, error handling, and security.

- Skill: `diegosouzapw/express` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add diegosouzapw/express`
- Raw SKILL.md: https://api.skillmd.com/api/skills/diegosouzapw/express/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: diegosouzapw (https://skillmd.com/u/diegosouzapw)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/diegosouzapw/express

---


# Express.js Best Practices

## Project Structure
- src/routes/ for route handlers
- src/middleware/ for middleware
- src/controllers/ for business logic
- src/models/ for data models
- src/utils/ for utilities

## Middleware
- Use helmet for security headers
- Use cors for CORS handling
- Use morgan for logging
- Use compression for gzip
- Use express.json() for body parsing
- Order middleware correctly

## Error Handling
- Use async error wrapper or express-async-errors
- Centralized error handler middleware
- Send appropriate status codes
- Log errors with context
- Never expose stack traces in production

## Security
- Validate all inputs with Joi/Zod
- Sanitize user data
- Use rate limiting
- Implement CSRF protection
- Use secure session config

## Performance
- Use caching (Redis)
- Implement pagination
- Use streaming for large responses
- Enable gzip compression
- Use connection pooling for databases