CodeVetter · Repo Unpack · Feature catalog
expressjs/express
The user-facing surface is three prototypes plus a factory. `app` provides configuration (`set`/`get`/`enable`/`disable`/`enabled`/`disabled`), composition (`use`, `route`, `param`, `all`, one method per `http.METHODS` entry), templating (`engine`, `render`) and lifecycle (`listen`, `path`). `res` provides ~24 response helpers built around `res.send`. `req` provides content negotiation and a set of lazily-computed getters derived from headers and the trust-proxy setting. The `examples/` tree doubles as documentation for 26 usage patterns and as the fixture set for acceptance tests.
- HTTP verb methods are generated dynamically: `methods.forEach` iterates `require('node:http').METHODS` lowercased and defines `app[method]`, with `app.get(name)` special-cased to read a setting when called with exactly one argument.
- `app.all(path, ...fns)` registers the same handlers against every method in the generated `methods` list rather than using a wildcard.
- `app.set()` has four magic settings that compile a companion function: `etag`→`etag fn`, `query parser`→`query parser fn`, `trust proxy`→`trust proxy fn`; each compiler throws `TypeError` on unknown string values.
- Defaults set at boot: `x-powered-by` enabled, `etag` = `weak`, `query parser` = `simple` (node querystring), `subdomain offset` = 2, `trust proxy` = false, `jsonp callback name` = `callback`, `views` = `resolve('views')`, and `view cache` auto-enabled when `NODE_ENV === 'production'`.
- `app.use()` detects a mounted sub-app by duck-typing `fn.handle && fn.set`, wraps it in a `mounted_app` middleware that restores the parent's `req`/`res` prototypes on the way out, sets `mountpath`/`parent`, and emits `'mount'`.
- The `'mount'` listener installed in `defaultConfiguration` makes a child app prototype-inherit the parent's `request`, `response`, `engines` and `settings`, and drops its own default `trust proxy` so the parent's wins.
- `res.send` is the funnel for almost every response: it type-switches on the body, sets Content-Type, computes Content-Length (skipped when `Transfer-Encoding` is present), generates an ETag, downgrades to 304 when `req.fresh`, strips headers for 204/304/205, and skips the body for HEAD.
- `res.json` and `res.jsonp` share a `stringify()` helper honouring the `json replacer`, `json spaces` and `json escape` settings, where `json escape` rewrites `<`, `>`, `&` to `\u003c`/`\u003e`/`\u0026` to defeat HTML sniffing.
- `res.sendFile(path, opts, cb)` requires an absolute path or an explicit `opts.root`, `encodeURI`s the path, wires `opts.etag` from the app setting, and pipes a `send` stream through the local `sendfile()` state machine; `EISDIR` falls through to `next()`.
- `res.download()` layers `Content-Disposition` (via `content-disposition`) on top of `res.sendFile`, explicitly dropping any user-supplied `content-disposition` header and resolving the path when no `root` is given.
- `res.format(obj)` negotiates on the object's keys via `req.accepts`, always sets `Vary: Accept`, falls back to an optional `default` key, and otherwise calls `next(createError(406, { types }))`.
- `res.redirect` is itself implemented on top of `res.format`, emitting a plain-text or escaped-HTML body for the target, and uses `depd` deprecation warnings for missing/non-string URLs and non-numeric statuses.
- Cookie support: `res.cookie` JSON-prefixes object values with `j:`, signs with `s:` + `cookie-signature` when `opts.signed` (requiring `req.secret` from cookie-parser), converts `maxAge` to both `expires` and seconds, and defaults `path` to `/`; `res.clearCookie` forces `expires: new Date(1)` and deletes `maxAge`.
- Request-side features are all lazy getters defined through a local `defineGetter` helper: `query`, `protocol`, `secure`, `ip`, `ips`, `subdomains`, `path`, `host`, `hostname`, `fresh`, `stale`, `xhr` — plus the methods `get`/`header`, `accepts*`, `range`, `is`.
- `req.fresh` only performs weak validation for `GET`, `HEAD` and `QUERY` methods and only for 2xx/304 statuses, reading `ETag` and `Last-Modified` back off the response.
- The `examples/` tree is a catalogued feature gallery of 26 runnable apps (auth, mvc, vhost, multi-router, view-constructor, web-service, …), indexed in `examples/README.md`.