The Express ecosystem has many ready-made middleware packages. cors handles Cross-Origin Resource Sharing headers, helmet sets security-related HTTP headers, and morgan provides HTTP request logging.
Node.js
Beginner
8 min read
Third-Party Middleware: cors, helmet, morgan
Example
// Install:
// npm install cors helmet morgan
const express = require('express');
const cors = require('cors');
const helmet = require('helmet');
const morgan = require('morgan');
const app = express();
// helmet — sets security headers automatically:
app.use(helmet());
// cors — allow requests from specific origins:
app.use(cors({
origin: ['https://myapp.com', 'http://localhost:5173'],
methods: ['GET', 'POST', 'PUT', 'DELETE'],
allowedHeaders: ['Content-Type', 'Authorization'],
credentials: true,
}));
// morgan — log requests in 'dev' format:
// GET /api/users 200 5.123 ms - 82
app.use(morgan('dev'));
// For production logging to a file:
const fs = require('fs');
const path = require('path');
const logStream = fs.createWriteStream(path.join(__dirname, 'access.log'), { flags: 'a' });
// app.use(morgan('combined', { stream: logStream }));
app.use(express.json());
app.get('/api/users', (req, res) => {
res.json([{ id: 1, name: 'Alice' }]);
});
app.listen(3000, () => console.log('Secured server on port 3000'));