express

express Best Practices

Express.js is the backbone of many Node.js backends. To build scalable, maintainable, and secure APIs in 2025, you must adhere to strict coding standards. This guide provides the definitive rules for our team.

1. Code Organization and Structure

Adopt a modular, layered architecture. This is non-negotiable for maintainability.

1.1. Enforce a Strict Modular Folder Structure

Separate concerns into dedicated directories.

❌ BAD: Monolithic server.js

// server.js
const express = require('express');
const app = express();
const mongoose = require('mongoose');
// ... all models, routes, controllers, middleware here
app.get('/users', async (req, res) => { /* ... */ });
mongoose.connect('...');
app.listen(3000);

✅ GOOD: Layered Structure

📁 src/
 ├── config/          # Environment variables, DB connection
 ├── controllers/     # Request handling, orchestrates services
 ├── models/          # Mongoose schemas, data access
 ├── routes/          # API endpoint definitions
 ├── middlewares/     # Reusable Express middleware
 ├── services/        # Core business logic
 ├── utils/           # Helper functions
 ├── app.js           # Express app setup, middleware, route registration
 └── server.js        # Server start, DB connection, graceful shutdown
📁 .env               # Environment variables

1.2. Separate app.js from server.js

app.js configures the Express application. server.js starts the HTTP server and handles infrastructure (DB connection, graceful shutdown). This enables easier testing and deployment.

src/app.js

const express = require('express');
const helmet = require('helmet');
const cors = require('cors');
const userRoutes = require('./routes/userRoutes');
const { notFound, errorHandler } = require('./middlewares/errorMiddleware');

const app = express();

app.use(helmet()); // Essential security headers
app.use(cors());   // Enable CORS
app.use(express.json()); // Body parser

app.use('/api/v1/users', userRoutes);

app.use(notFound);
app.use(errorHandler);

module.exports = app; // Export app for server.js and testing