# Feature catalog — expressjs/express

> Canonical page: https://codevetter.com/unpack/express/feature-catalog

# Feature catalog — expressjs/express

Scanned commit 9a34acf03cb818ff3f8bc40e44176e277a25cbb9 (2026-09-15). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

The user-facing surface is three prototypes plus a factory. `app` provides configuration (`set`/`get`/`enable`/`disable`/`enabled`/`disabled`), composition (`use`, `route`, `param`, `all`, one method per `http.METHODS` entry), templating (`engine`, `render`) and lifecycle (`listen`, `path`). `res` provides ~24 response helpers built around `res.send`. `req` provides content negotiation and a set of lazily-computed getters derived from headers and the trust-proxy setting. The `examples/` tree doubles as documentation for 26 usage patterns and as the fixture set for acceptance tests.
- HTTP verb methods are generated dynamically: `methods.forEach` iterates `require('node:http').METHODS` lowercased and defines `app[method]`, with `app.get(name)` special-cased to read a setting when called with exactly one argument. — [lib/application.js#L471-L483](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/application.js#L471-L483) [lib/utils.js#L29](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/utils.js#L29)
- `app.all(path, ...fns)` registers the same handlers against every method in the generated `methods` list rather than using a wildcard. — [lib/application.js#L492-L501](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/application.js#L492-L501) [test/app.all.js](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/test/app.all.js)
- `app.set()` has four magic settings that compile a companion function: `etag`→`etag fn`, `query parser`→`query parser fn`, `trust proxy`→`trust proxy fn`; each compiler throws `TypeError` on unknown string values. — [lib/application.js#L354-L382](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/application.js#L354-L382) [lib/utils.js#L130-L215](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/utils.js#L130-L215) [test/config.js#L41-L52](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/test/config.js#L41-L52)
- Defaults set at boot: `x-powered-by` enabled, `etag` = `weak`, `query parser` = `simple` (node querystring), `subdomain offset` = 2, `trust proxy` = false, `jsonp callback name` = `callback`, `views` = `resolve('views')`, and `view cache` auto-enabled when `NODE_ENV === 'production'`. — [lib/application.js#L90-L145](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/application.js#L90-L145)
- `app.use()` detects a mounted sub-app by duck-typing `fn.handle && fn.set`, wraps it in a `mounted_app` middleware that restores the parent's `req`/`res` prototypes on the way out, sets `mountpath`/`parent`, and emits `'mount'`. — [lib/application.js#L190-L241](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/application.js#L190-L241) [test/app.use.js](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/test/app.use.js)
- The `'mount'` listener installed in `defaultConfiguration` makes a child app prototype-inherit the parent's `request`, `response`, `engines` and `settings`, and drops its own default `trust proxy` so the parent's wins. — [lib/application.js#L109-L123](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/application.js#L109-L123)
- `res.send` is the funnel for almost every response: it type-switches on the body, sets Content-Type, computes Content-Length (skipped when `Transfer-Encoding` is present), generates an ETag, downgrades to 304 when `req.fresh`, strips headers for 204/304/205, and skips the body for HEAD. — [lib/response.js#L126-L226](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/response.js#L126-L226)
- `res.json` and `res.jsonp` share a `stringify()` helper honouring the `json replacer`, `json spaces` and `json escape` settings, where `json escape` rewrites `<`, `>`, `&` to `\u003c`/`\u003e`/`\u0026` to defeat HTML sniffing. — [lib/response.js#L236-L260](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/response.js#L236-L260) [lib/response.js#L1025-L1049](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/response.js#L1025-L1049)
- `res.sendFile(path, opts, cb)` requires an absolute path or an explicit `opts.root`, `encodeURI`s the path, wires `opts.etag` from the app setting, and pipes a `send` stream through the local `sendfile()` state machine; `EISDIR` falls through to `next()`. — [lib/response.js#L375-L430](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/response.js#L375-L430) [lib/response.js#L923-L1010](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/response.js#L923-L1010)
- `res.download()` layers `Content-Disposition` (via `content-disposition`) on top of `res.sendFile`, explicitly dropping any user-supplied `content-disposition` header and resolving the path when no `root` is given. — [lib/response.js#L437-L486](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/response.js#L437-L486) [test/res.download.js](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/test/res.download.js)
- `res.format(obj)` negotiates on the object's keys via `req.accepts`, always sets `Vary: Accept`, falls back to an optional `default` key, and otherwise calls `next(createError(406, { types }))`. — [lib/response.js#L573-L604](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/response.js#L573-L604) [test/res.format.js](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/test/res.format.js)
- `res.redirect` is itself implemented on top of `res.format`, emitting a plain-text or escaped-HTML body for the target, and uses `depd` deprecation warnings for missing/non-string URLs and non-numeric statuses. — [lib/response.js#L814-L870](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/response.js#L814-L870) [lib/response.js#L17](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/response.js#L17)
- Cookie support: `res.cookie` JSON-prefixes object values with `j:`, signs with `s:` + `cookie-signature` when `opts.signed` (requiring `req.secret` from cookie-parser), converts `maxAge` to both `expires` and seconds, and defaults `path` to `/`; `res.clearCookie` forces `expires: new Date(1)` and deletes `maxAge`. — [lib/response.js#L714-L777](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/response.js#L714-L777) [test/res.cookie.js](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/test/res.cookie.js) [test/res.clearCookie.js](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/test/res.clearCookie.js)
- Request-side features are all lazy getters defined through a local `defineGetter` helper: `query`, `protocol`, `secure`, `ip`, `ips`, `subdomains`, `path`, `host`, `hostname`, `fresh`, `stale`, `xhr` — plus the methods `get`/`header`, `accepts*`, `range`, `is`. — [lib/request.js#L230-L527](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/request.js#L230-L527)
- `req.fresh` only performs weak validation for `GET`, `HEAD` and `QUERY` methods and only for 2xx/304 statuses, reading `ETag` and `Last-Modified` back off the response. — [lib/request.js#L469-L486](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/lib/request.js#L469-L486) [test/req.fresh.js](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/test/req.fresh.js)
- The `examples/` tree is a catalogued feature gallery of 26 runnable apps (auth, mvc, vhost, multi-router, view-constructor, web-service, …), indexed in `examples/README.md`. — [examples/README.md#L1-L28](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/examples/README.md#L1-L28) [examples/mvc/index.js](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/examples/mvc/index.js) [examples/view-constructor/index.js](https://github.com/expressjs/express/blob/9a34acf03cb818ff3f8bc40e44176e277a25cbb9/examples/view-constructor/index.js)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)