Handling Requests
1. Accessing Request Object
| Inherits From | Detail |
|---|
http.IncomingMessage | Node.js base class — stream + headers |
| Express extensions | params, query, body, ip, route, etc. |
2. Reading Request Parameters
Example: req.params
app.get("/orgs/:orgId/users/:userId", (req, res) => {
res.json({ org: req.params.orgId, user: req.params.userId });
});
| Property | Source |
|---|
req.params | URL named segments |
req.params[0] | Wildcard / unnamed regex group |
3. Reading Query Strings
| Source | Property |
|---|
| Parsed query | req.query |
| Raw query string | req.url.split("?")[1] |
4. Accessing Request Body
Example: JSON body
app.use(express.json());
app.post("/users", (req, res) => {
const { name, email } = req.body;
res.status(201).json({ name, email });
});
Note: req.body is undefined until a body parser middleware runs.
| API | Description |
|---|
req.headers | All headers (lowercase keys) |
req.get(name) / req.header(name) | Case-insensitive lookup |
req.headers["x-custom"] | Direct access |
Example: Bearer token
const auth = req.get("Authorization") || "";
const token = auth.startsWith("Bearer ") ? auth.slice(7) : null;
6. Getting Request Method
| Property | Value |
|---|
req.method | "GET", "POST", "PUT", "PATCH", "DELETE", etc. (uppercase) |
req.xhr | true if X-Requested-With: XMLHttpRequest |
7. Getting Request URL
| Property | Example for GET /api/users?x=1 mounted at /api |
|---|
req.originalUrl | /api/users?x=1 (full path with query) |
req.baseUrl | /api (router mount path) |
req.url | /users?x=1 (after baseUrl strip) |
req.path | /users (no query) |
8. Getting Request Path
Example: Path-based logic
app.use((req, res, next) => {
if (req.path.startsWith("/admin")) return requireAdmin(req, res, next);
next();
});
9. Checking Request Protocol
| Property | Value |
|---|
req.protocol | "http" or "https" (honors X-Forwarded-Proto if trust proxy) |
req.secure | req.protocol === "https" |
Example: Force HTTPS redirect
app.use((req, res, next) => {
if (req.secure || req.hostname === "localhost") return next();
res.redirect(301, `https://${req.hostname}${req.originalUrl}`);
});
10. Getting Request Hostname
| Property | Source |
|---|
req.hostname | Host header (or X-Forwarded-Host with trust proxy) |
req.subdomains | Array (tenant1.api.example.com → ["tenant1","api"]) |
11. Accessing Request IP
| Property | Behavior |
|---|
req.ip | Client IP (uses X-Forwarded-For if trust proxy set) |
req.ips | Array of all proxy hops |
req.socket.remoteAddress | Raw TCP peer (always direct) |
Warning: Without trust proxy, req.ip returns the load balancer's IP, not the real client.
12. Reading Cookies
Example: cookie-parser
import cookieParser from "cookie-parser";
app.use(cookieParser(env.COOKIE_SECRET));
app.get("/", (req, res) => {
const session = req.cookies.session;
const signed = req.signedCookies.userId;
res.json({ session, signed });
});
| Property | Description |
|---|
req.cookies | Parsed cookies (object) |
req.signedCookies | Verified signed cookies |
13. Checking Content Type
Example: req.is()
if (req.is("json")) handleJson();
else if (req.is("urlencoded")) handleForm();
else if (req.is("multipart/*")) handleUpload();
else res.sendStatus(415);
| Pattern | Matches |
|---|
"json" | application/json, application/*+json |
"html" | text/html |
"text/*" | Any text subtype |
"image/png" | Exact |