Middleware adalah fungsi yang dijalankan SEBELUM handler route. Seperti "filter" yang dilalui setiap request.

Alur request:

Request → Middleware 1 → Middleware 2 → Route Handler → Response

Membuat middleware:

// Logger middleware
function logger(req, res, next) {
  console.log(`${req.method} ${req.url}`);
  next(); // Lanjut ke middleware/handler berikutnya
}

app.use(logger); // Terapkan ke SEMUA route

Middleware bawaan Express:

// Parse JSON body
app.use(express.json());

// Parse URL-encoded body (form data)
app.use(express.urlencoded({ extended: true }));

Middleware untuk route tertentu:

function authMiddleware(req, res, next) {
  const token = req.headers.authorization;
  if (!token) {
    return res.status(401).json({ error: "Unauthorized" });
  }
  next();
}

// Hanya route ini yang memerlukan auth
app.get("/profile", authMiddleware, (req, res) => {
  res.json({ user: "Budi" });
});

Urutan middleware penting! Middleware dieksekusi sesuai urutan app.use().

Common Ecosystem — middleware yang hampir selalu dipakai:

import helmet from "helmet";
import cors from "cors";
import compression from "compression";
import morgan from "morgan";
import rateLimit from "express-rate-limit";

app.use(helmet());                              // security headers (XSS, clickjacking)
app.use(cors({ origin: "https://myapp.com" })); // kontrol cross-origin
app.use(compression());                         // gzip response → lebih cepat
app.use(morgan("dev"));                         // log tiap request ke console
app.use(rateLimit({ windowMs: 60_000, max: 100 })); // batasi 100 req/menit