Why should you care?

Cross-cutting concerns belong in middleware, not duplicated in every route handler.

See it live — copy this example

Paste into your MeanVerse project (Angular + Express + MongoDB), then run with ng serve / node / mongosh as noted.

export function requestLogger(req: Request, _res: Response, next: NextFunction) {
  const start = Date.now();
  _res.on('finish', () => {
    console.error(`${req.method} ${req.path} ${_res.statusCode} ${Date.now() - start}ms`);
  });
  next();
}

export function requireRole(role: string) {
  return (req: Request, res: Response, next: NextFunction) => {
    if (!req.user?.roles.includes(role)) return res.status(403).json({ message: 'Forbidden' });
    next();
  };
}

What happened?

• next() passes control downstream.
• requireRole returns middleware closure checking JWT roles.
• Logger attaches on finish event for timing.

Practice next

1. Add requestLogger globally with app.use.
2. Create auth middleware verifying JWT on req.headers.authorization.
3. Apply requireRole('admin') only on admin routes.
4. Add correlation-id middleware from x-request-id header.
5. Skip logging for /health in conditional middleware.

Remember

Middleware order matters. Reuse auth and logging globally. Factory pattern for parameterized middleware.

Audit trail

Banking regulator requires who accessed which account API.

Outcome: Logger middleware records user id and route on every call.