Operations in Express.js

Operations is the eighth chapter of the free Express.js tutorial. It covers what you need to run an Express app for real users.

What each lesson covers:

  • Logging and Debugging: Request logs, request IDs, Morgan, safe error logs, DEBUG output and a method for finding bugs.
  • Express Security: Helmet, HTTPS, CORS, XSS and CSRF, rate limits, timeouts, secrets and a review checklist.
  • Deploying an Express App: Config from environment variables, NODE_ENV, npm start and PM2, health checks, graceful shutdown on SIGTERM, Docker, hosting and HTTPS.

This chapter takes an app from your computer to production. The security lesson adds headers with Helmet, HTTPS, CORS, and protection against cross-site scripting, cross-site request forgery and abuse, then ends with a review checklist. The logging lesson decides what to log, adds request IDs, uses Morgan and Express's own DEBUG output, and walks through common problems. The deployment lesson reads settings from environment variables, runs the app with npm start and a process manager, adds health checks and graceful shutdown, and covers Docker, hosting and HTTPS.

Every lab runs a real Express 5 server in your browser. Press Stop to send SIGTERM, just like a host does.

Lessons in this section

  1. Logging and Debugging

    What to log, a custom logger with the finish event, request IDs, Morgan formats and custom tokens, error logging, the DEBUG environment variable, debugging routes, middleware order and async handlers, and health checks.

    • Log method, URL, status and time for every request
    • Add request IDs to logs and answers
    • Use Morgan formats and custom tokens
    • Use DEBUG output
  2. Express Security

    Security headers with Helmet, HTTPS, CORS and why it is not authentication, XSS and CSRF, rate limiting, request timeouts, keeping secrets safe, the order of security middleware, and a security review checklist.

    • Add security headers with Helmet
    • Configure CORS with an allowlist
    • Defend against XSS and CSRF
    • Rate limit logins and time out slow requests
  3. Deploying an Express App

    Config from environment variables, failing fast, NODE_ENV=production, npm start and PM2, liveness and readiness checks, graceful shutdown on SIGTERM, Docker, hosting platforms and HTTPS.

    • Read config from the environment and fail fast
    • Run in production mode on the host's port
    • Add liveness and readiness checks
    • Shut down cleanly on SIGTERM