Middleware testing strategies in Express - Mini Project: Build & Apply

Middleware Testing Strategies in Express

📖 Scenario: You are building a simple Express server that uses middleware to check if a user is authenticated before allowing access to a protected route.Testing middleware is important to ensure your server behaves correctly and securely.

🎯 Goal: Build and test an Express middleware function that checks for a specific header to simulate authentication.You will write the middleware, configure a test flag, apply the middleware to a route, and complete the test setup.

📋 What You'll Learn

Create an Express middleware function named authMiddleware that checks for the header x-auth-token.

Create a configuration variable isTest to simulate test mode.

Apply authMiddleware to a route /protected that sends a success message if authenticated.

Complete the Express app setup to listen on port 3000.

💡 Why This Matters

🌍 Real World

Middleware is used in real web servers to check authentication, log requests, handle errors, and more. Testing middleware ensures your server is secure and reliable.

💼 Career

Understanding middleware and how to test it is essential for backend developers working with Express or similar web frameworks.

1

Create the Express app and middleware function

Create an Express app by requiring express and calling express(). Then create a middleware function called authMiddleware that checks if the request header x-auth-token exists. If it does, call next(), otherwise respond with status 401 and message 'Unauthorized'.

Express

const express = require('express');
const app = express();

// Create authMiddleware function here
// Your code here

Hint

Use req.headers['x-auth-token'] to check the header. Call next() if it exists, else respond with 401.

2

Add a test mode configuration variable

Create a boolean variable called isTest and set it to true to simulate test mode.

Express

const express = require('express');
const app = express();

function authMiddleware(req, res, next) {
    if (req.headers['x-auth-token']) {
        next();
    } else {
        res.status(401).send('Unauthorized');
    }
}

// Create isTest variable here
// Your code here

Hint

Just create a variable isTest and set it to true.

3

Apply middleware to a protected route

Use app.get to create a route /protected that uses authMiddleware. If the middleware passes, respond with 'Access granted'.

Express

const express = require('express');
const app = express();

function authMiddleware(req, res, next) {
    if (req.headers['x-auth-token']) {
        next();
    } else {
        res.status(401).send('Unauthorized');
    }
}

const isTest = true;

// Create /protected route using authMiddleware
// Your code here

Hint

Use app.get('/protected', authMiddleware, (req, res) => { ... }) to add the route.

4

Complete the Express app setup

Add app.listen to start the server on port 3000.

Express

const express = require('express');
const app = express();

function authMiddleware(req, res, next) {
    if (req.headers['x-auth-token']) {
        next();
    } else {
        res.status(401).send('Unauthorized');
    }
}

const isTest = true;

app.get('/protected', authMiddleware, (req, res) => {
    res.send('Access granted');
});

// Start server on port 3000
// Your code here

Hint

Use app.listen(3000) to start the server.

Practice

1. What is the main purpose of testing middleware in an Express app?

easy

A. To verify that middleware correctly processes requests and responses

B. To check the database connection speed

C. To test the frontend user interface

D. To measure server hardware performance

Solution

1. Step 1: Understand middleware role

   Middleware functions handle requests and responses in Express apps.

2. Step 2: Identify testing focus

   Testing middleware ensures it processes requests and responses correctly.

3. Final Answer:

   To verify that middleware correctly processes requests and responses -> Option A

4. Quick Check:

   Middleware testing = request/response handling [OK]

Hint: Middleware tests check request and response flow [OK]

Common Mistakes:

• Confusing middleware testing with UI testing
• Testing unrelated server hardware
• Ignoring request and response handling

2. Which syntax correctly uses a testing library to simulate a request to Express middleware?

easy

A. request(app).get('/path').expect(200, done)

B. app.request('/path').send(200)

C. middleware.test('/path').status(200)

D. express.test(app).get('/path').check(200)

Solution

1. Step 1: Recognize common testing syntax

   Using 'request(app).get(path).expect(status, done)' is standard with supertest library.

2. Step 2: Compare options

   Only request(app).get('/path').expect(200, done) matches valid syntax for simulating requests in Express tests.

3. Final Answer:

   request(app).get('/path').expect(200, done) -> Option A

4. Quick Check:

   Simulate request = request(app).get() [OK]

Hint: Use request(app).get() to simulate Express requests [OK]

Common Mistakes:

• Using non-existent methods like app.request()
• Confusing middleware with app methods
• Incorrect chaining of test methods

3. Given this middleware test snippet, what will be the output if the middleware calls next() without error?

app.use((req, res, next) => {
  if (req.query.fail) return next(new Error('Fail'));
  res.status(200).send('Success');
});

request(app).get('/?fail=true').expect(500, done);

medium

A. The test passes with status 200

B. The test fails because status 200 is sent

C. The test throws a syntax error

D. The test passes because error triggers 500 status

Solution

1. Step 1: Analyze middleware behavior on fail query

   If req.query.fail is true, middleware calls next() with an error, triggering Express error handling.

2. Step 2: Understand test expectation

   The test expects status 500, which matches Express default error response status.

3. Final Answer:

   The test passes because error triggers 500 status -> Option D

4. Quick Check:

   Error passed to next() = 500 response [OK]

Hint: Error in next() triggers 500 status by default [OK]

Common Mistakes:

• Assuming next() without error sends 200
• Ignoring error passed to next()
• Confusing status codes for errors

4. You wrote this test but it always times out. What is the likely error?

app.use((req, res, next) => {
  if (!req.headers.auth) return res.status(401);
  next();
});

request(app).get('/').expect(401, done);

medium

A. next() is called twice causing conflict

B. Missing res.send() causes response never to finish

C. Incorrect HTTP method used in request

D. Middleware does not check headers properly

Solution

1. Step 1: Check middleware response on missing auth

   res.status(401) sets status but does not end response without res.send() or res.end().

2. Step 2: Understand test timeout cause

   Without ending response, test waits indefinitely causing timeout.

3. Final Answer:

   Missing res.send() causes response never to finish -> Option B

4. Quick Check:

   res.status() alone doesn't end response [OK]

Hint: Always end response with res.send() or res.end() [OK]

Common Mistakes:

• Assuming res.status() ends response
• Calling next() after sending response
• Using wrong HTTP method in test

5. You want to test middleware that conditionally modifies the request object and passes control. Which approach best ensures both modification and flow are tested?

hard

A. Test middleware by calling it without any request data

B. Only check the final response status code

C. Use a mock request object and spy on next() to confirm it was called

D. Skip testing and rely on manual checks

Solution

1. Step 1: Understand middleware modifies request and calls next()

   Testing must confirm request changes and that next() is called to continue flow.

2. Step 2: Choose testing approach

   Using a mock request and spying on next() lets you verify both modification and flow control.

3. Final Answer:

   Use a mock request object and spy on next() to confirm it was called -> Option C

4. Quick Check:

   Mock request + spy next() = full middleware test [OK]

Hint: Spy next() and check request changes for full test [OK]

Common Mistakes:

• Ignoring next() call verification
• Testing only response status
• Not providing request data in tests