Express Routing and Route Parameters

Route requests by method, path and validated parameters

A route combines an HTTP method with a path. GET /api/exams and POST /api/exams can use the same URL for different operations. A route parameter identifies a resource, while query parameters usually filter or paginate a collection. Both arrive as untrusted input and must be checked before use.

Organize an exam router

In an Express 5 practice project, save this complete example as routes.mjs and run node routes.mjs.

import express from 'express';
const app = express();
const router = express.Router();
const exams = [
  { id: 1, title: 'JavaScript Basics' },
  { id: 2, title: 'Node Foundations' }
];

router.get('/', (req, res) => {
  const raw = req.query.limit ?? '10';
  if (typeof raw !== 'string' || !/^[1-9][0-9]*$/.test(raw)) {
    return res.status(400).json({ error: 'limit must be a positive integer' });
  }
  const limit = Number(raw);
  if (!Number.isSafeInteger(limit) || limit > 50) {
    return res.status(400).json({ error: 'limit cannot exceed 50' });
  }
  res.json({ data: exams.slice(0, limit) });
});
router.get('/summary', (req, res) => res.json({ total: exams.length }));
router.get('/:id', (req, res) => {
  const raw = req.params.id;
  if (!/^[1-9][0-9]*$/.test(raw) || !Number.isSafeInteger(Number(raw))) {
    return res.status(400).json({ error: 'Invalid exam id' });
  }
  const exam = exams.find(item => item.id === Number(raw));
  if (!exam) return res.status(404).json({ error: 'Exam not found' });
  res.json({ data: exam });
});
app.use('/api/exams', router);
app.use((req, res) => res.status(404).json({ error: 'Route not found' }));
app.listen(3000, '127.0.0.1');

Read the URLs precisely

/api/exams/2 sets req.params.id to the string "2". /api/exams?limit=1 sets req.query.limit to "1". /api/exams/summary matches the fixed route before /:id. Router paths are relative to the mount point, so repeating /api/exams inside the router would produce a duplicated prefix.

Do not use parseInt alone to validate an ID: parseInt('2abc', 10) yields 2. Check the complete string and numeric range. Query values can also have unexpected shapes, which is why the code checks their type. Database existence and access permissions are separate checks after syntactic validation.

Routing failures you should recognize

An unmatched method normally falls through unless you explicitly implement a 405 response. A route must respond or pass control with next(). Calling next after sending a response may let another handler send again. Keep API path naming consistent and avoid placing actions such as getAllExams in every path when ordinary HTTP methods already express the operation.

Practice checkpoint

Test /api/exams/1 (200), /api/exams/99 (404), /api/exams/2abc (400), /api/exams?limit=0 (400), and /api/exams/summary (200). Add a title search with a bounded string query. Decide whether matching is case-sensitive and document that choice. Never expose answer keys in a public collection response.