The answer
express.json, express.urlencoded, cors, helmet, a logger (morgan or pino-http), express-rate-limit, cookie-parser (if using cookies), compression, a custom auth middleware, a validation middleware, and an error-handling middleware.
Express Middlewares Every Server Needs
Which middlewares does every Express server need?
More FAQs in Express Middlewares Every Server Needs
It sets security HTTP headers (X-Frame-Options, Strict-Transport-Security, Content-Security-Policy basics) that protect against clickjacking, sniffing, and other common attacks. Set it and forget it.
Limits requests per IP to prevent abuse and brute-force attacks. Add a global limiter (e.g., 100 req per 15 min) and stricter limiters on auth routes (5 login attempts per 15 min). It is a small addition with big protection.
Yes. Express runs middlewares in the order you add them. Add global ones (json, cors, helmet, compression) first, then routers, then the error-handling middleware last. Wrong order causes bugs (e.g., body parser after routes means req.body is undefined).
Still have questions?
Browse all our FAQs or reach out to our support team
Want to upskill yourself?
Your learning library
Small steps. Big possibilities.
Find your next course. Build something great.