Express JS Mistakes Every Junior Developer should Avoid | clean-code

so if you're a gene developer or just getting started with express.js then you're probably doing a lot of mistakes so in this video I'm going to look what are the mistakes that you should avoid as a junior developer when starting out with express.js or when building your first application express.js from properly using error handlers to validation to security best practices and headers and so much more to go from a junior developer into a senior developer so if you try to look over the Internet for like Express mistakes or what you should do and don't using Express GS you gotta find a lot of things and some of them are just super kind of stupid and they are very obvious and some of them are actually good and descriptive and actually improve your skill set so the first one in here which a lot of developers especially a lot of Junior developers don't pay attention to when getting started when like building their first express.js kind of application which is error handling so error handling is very very important and here if you just look at the express.js website of official documentation it's telling you that you Expressions by default catches and processes errors are both awkward synchronously and asynchronously and yes it has like a Devo error handling but like the default is is just pretty pretty basic and it's pretty default and it always returns like an HTML kind of error to the users which is most of the time not a good idea for your application so what you've got to do is actually Define your own custom error Handler with a custom logic so let's say we've got this particular very simple example in here so without saying we have got like error handling here I'm using a router I'm just like building you know a simple express.js in here with a router that is bound together with you know the actual express.js application and stuff like that so technical in here for example for the bad approach in here or so let's say oh you got like an error or something and you want to throw an error of course when you throw an arrowhead or it's going to automatically being handled by express.js and once it's done it's going to be calling the default error Handler and while the default air handler is going to do is it's just gonna take the air in here it's gonna process it in some way it might mean for a default one just gonna rotate to you like return to the user like a 500 internally server error or something and with the error message that you just provided in here and that's it so as I said before by default express.js actually provides you with a default air handler now to change that one way you gotta actually go ahead and do for example for us you can go to like a create like a midwest.typescript kind of file and put inside of it like a function so an error Handler is just another simple function now what's actually special about this function is actually has another parameter an extra parameter that actually comes before all the other default Express like handlers parameters which is the error parameter and you've got later on you got like the request the response and the next which is as usual as like any other kind of express.js Handler so simply with this one you can actually customize it or you can do whatever you want for example here what I'm doing actually checking the status code of the response so if it's 200 I can just return you know the status code in here or if it's still 500 in here just like you know by default go ahead and do 500 set the response status in here I can get like oh response body with a custom message and you can just do stack Trace if it's not production and I can use some custom login which is pretty good so you can just log something if you're if you're using some you know log into files or log into a database so if you have like a custom login Logic for your application in here or you just log into a database or something or just do the console as we do it in here you can actually customize that actually have a you know a regular login in here and last but only is you can respond with a response body in here which is going to show an error to the end user now once you actually have got your error Handler in here you can go back to the app gen here and you can actually go ahead and use the error Handler so you can do app.eus mirrors and error Handler and by default one thing actually you need to not forget about doing this one for error Handler is you need to make sure your air handler is defined the last one so what I mean by this actually you want to make sure that the air handler middleware is actually the last one that gets added to the middle words kind of Stack so that means actually you for any other mirrors in here you have got to Define them before actually Define the aerial handle in here and it has to be in order for like expert genius to know oh there's actually an error Handler and it's just gonna call it I know of course for the good one in here because we already defined the area Handler now it's actually pretty good and I can throw in here it's going to be handled by our error Handler and particularly what I can do as well in here I can just do response dot status code I can say for example to 400 and this will set the status code for the error in here I'm just throwing and of course that's actually a custom logic we added to our own you know custom error Handler now if you go to post menu actually try to call the error handload with the bad example like with a default air handler from express.js this is actually what you're going to get back you're going to get better like an HTML page with your ear in here oh something went sideways or something and then some stack Trace any of your development but if you try the good one in here and actually try to call it there you go that's actually our customized error Handler with a custom message in here so I was curious if it's being called by our custom error Handler and if we look into our console here the login is working as well that means our custom error Handler is working perfectly that way using a custom error Handler you can make sure actually you can customize everything actually control your areas control what gets logged out control what gets returned back to the users to see their errors the second mistake is not using validation so there's actually really also my brain here called joy and I'm pretty sure a lot of you maybe already heard about this one which is a pretty pretty nice Library it's for validation pretty lightweight and has tons and tons of stuff so Joy works perfectly with Express and actually many other servers out there it's open source has like almost 20 case turns so that would actually save the day for us so simple you can just make sure to go ahead and install that one inside of your express.js kind of projects in here using like dependencies and install Joy once you do that you're actually in a good place now for how actually validation Works let's compare the bad example we're not using validation at all versus the good one like while using validation so let's say in here we got like an Handler particularly hand learning like a post Handler that handles registering a new user so that means we're going to be needing like a username email something like a password you know like a user so if you're not using like a library and if you're not using a proper validation kind of mechanism with a middleware what you would probably want to do is actually access the body here for example you do request dot bounty to get the post body in here then you can just do body or for example say oh F body or not body.username go ahead and throw me this if it's not bought it or email go ahead and throw me this and if you have tons of stuff you can just do it again and again and again which is not super well made and it's not like you don't have a lot of options for example you can't really check if if the provider email or the string in here is an actual email or not so there's actually a lot of down signs and a lot of unfortunate stuff and actually can happen or go sideways if you want to will it to use it that way so instead what you should want to actually go ahead and use is we actually use Joy with creating a custom middleware so the Romero will just be a normal function in here that actually takes the joint schema now Joey the validation Library I'm going to be using actually you can provide you with schemas and schema is something like this you just do join.objects so you're pretty much expecting an object and the objects in here can have a username so you can do join this should be a string and it should be required as well as like oh if email there should be a string should be an email and this is required as well now inside of the middleware here we can simply just like you know return a normal middleware function that has request response at next and we can just use our schema in here to validate the request.body and simply if there's actually any error we can just return status 400 in here with the error message in here just to tell the user exactly where the issue is and what they should provide if something is missing and here we actually actually can go ahead and populate the new body value in here so you can just switch the body value in here with the new validated body awesome and finally here just not do next in here to move to the next Handler and of course we can use this valid request or validate request middleware in here in between so right before calling our Handler in here for the good one for example this this is actually the good one in here so before running that one we can just don't call their validate request passing it the schema that we just created and right after that one we can just go in and call it our middleware in here or basically call our Handler function or controller in here where you know we just now we're 100 sure that we can have username and email and if they are not provided by the user this point is not going to be reached because what's going to happen is just going to return a response in here right away if there are any schema issues or validation errors so if you try our handlers in here the bad versus the good one in Postman in here so for example running the band it's actually where it returns returns oh username is required and of course if you provide a username you can just have emails required so this is a really really ugly way and obviously try the good one in here with joint validation and our custom middleware in here so for example in here I'm I'm not providing no username or email and if I just try to do that I'm just going to get oh username is required that's it as simple as that nose track trees very good oh email is required so I do email now in here and I can just provide this one it says oh thanks for registering and everything would be good the third one is not utilizing and not using environment variables so if you're wondering what environment variables are environment variables are kind of like a variable that is only run and related to the environment whether your program or where your application is going to be run in but it's not going to be included as part of the source code so for example in here I got this dot EnV in here and where you this is actually a file where all you define your environment variables and they can be injected into the server you're running like express.js or node.js and for this one this is actually where your Divine just simple variables and the variables in here are usually stuff like oh an API token for example got this chat GPT API token or maybe some encryption passphrase in here so you only put like super duper kind of secret stuff or stuff for configuration for example you want to configure the port in here so you can easily configure that one without going ahead and actually changing the source code whenever you want to change for example the pores or you want to change like oh the node environment here when I'm putting into production instead of developments or any kind of variable you that needs configuration or needs like an API token something that doesn't require the actual code Change Plus those are actually super super safe because they're not transferred through a network they only live in the session they actually been running on they never live in the source code that's why they are called the environment variables so simply to utilize environment variables you've got two ways to do that the first one is pretty simple and the best way actually to do it is actually using a EMV file so you just create a DOT EMV file instead of your projects in here and you put all your environment variables in here then simply go ahead and actually use a package called dot EnV so you simply just go ahead and install that one so if I search for diamv just npm installing here with your install that one you do require WMV called config in here and this will go ahead and read all the environment variables in here into the actual express.js application now let's say we got this pretty simple application where we're gonna use chat GPT in here which is excuse me hgbt I'm just importing that one I'll clicking the official proxy API and here the band is actually just putting the access token of chat GPC in here right into the source code which is very bad very unsecure and really really just gonna make give you like a hard time whenever you're trying to change that API token or something goes wrong you never want to do that so they'll show you how you basically use it just hard code that one and now with a good approach how you want to use it it's actually using process.env and you do chat GPT AP Tok so you access it through process.env and you put the name of the variable in here that you have right in here so for example chat GPC API token that's you're going to have it right over here and that's super secure you can change it whenever you tell like whenever you want super configurable the second way you've got to actually use environment variable is actually whenever you try to run your script in here for example like yarn starting here you can actually put right before it like all the environment variables in here with like a variable name in here equals and the variable value and all of them are going to be just puts and populated inside of your you know node.js education or express.js application the fourth one is not a using API versioning now if you don't know what API version is basically when you add versions to the API endpoints back to the path of your API endpoints for everything so here for example we're prepending API forward slash V1 and we're using our API in here so the wrong way to utilize this one is just not providing API versions I mean this could work for you know the first and it just whenever you're starting a project you're going to work for a couple of years maybe or you know as far as like when you're actually not doing really huge breaking changes into your apis but once you actually introduce breaking changes or you want to actually keep two versions of the same API endpoints one an older version and one and newer version that's where it gets actually really complicated and that's when you actually need API versioning so here instead of just doing it API in here you can have all the apis you can just do API version in here for example oh API V1 this I'm going to use you can actually create for example another API in here and have like this folder structure where you got API you get right into it you got like V1 and V2 each they have their own route and stuff like that and each export a different you know API router in here and it can each assign them to different endpoint in here V1 and V2 now whenever you do have a really huge breaking change inside of your API or you want to introduce a new API endpoint or updates to an existing 8. exist on the V1 into the V2 you can easily do that and you can just tell your users or customers or clients oh I actually changed that to V2 so all you're going to do actually just change that to V2 and you're actually good to go believe me it works really well it's very important I had a lot of issues with that before you won't regret using it the fifth one is not securing your express.js server well by securing what I mean like using third-party libraries that are well known for security that provides really awesome out of the box kind of security they add headers and stuff like that and also in here for example this this is actually the documentation of express.js it actually performs you like security best best practices so it has a lot of stuff in here all of them are actually pretty good and make sure you just go ahead and read through all of those I'm not going to go into all the details because they are very well explained already but actually what I'm going to go through is actually the first one which is a really awesome Library I mean if you're not using this inside of your Xbox GS application or your express.js server you're basically missing out a lot of stuff so helmets in here actually allows you to add default headers so you just like adds out of the box default headers that are going to make your server 10x more secure and if you really want to know exactly what it adds were the type of headers they adds in here and you know the kind of like intention behind them you can actually read through here go to hellmagist github.io and you can read all the heroes and actually gets added for example in here as console security policy which is very important for your like server uh as like like cross origin opening policy that helps you know isolate your page from xss it helps like DNS issues download options frame hijacking and session hijacking and yes you can actually customize this to however you want for example for Content security policy you can add whatever directives you want in here for like you know script SRC your frame I mean if you don't know exactly what I'm talking about I would really you know kind of like voice together and check out what conse security policy how does it work and believe me it's worth it and because it's actually a middleware so you can easily just go in and do um don't use and you can just use helmets in here of course after installing that one the other important security aspect that you need to pay attention to is actually cross origin resource here which is course if you're not familiar with course already and how does it work and how you apply it there's actually a really really awesome video story I already made a while ago in here and it's pretty good it actually explains course really really well and how you can use it with Express and everything so I'm gonna find the link description below if you really want to watch it so simple in here there's actually a really awesome kind of npm kind of package that allows you to add quarters into your application and this will allow you to easily add by defaults some you know measures and and safety measures for Cores here is going to be added automatically of course you can customize and configure it however you want so simply all you're going to do is use emitter work course in here after installing of course and you can customize for example however you want for example if you want origin in here you can say oh I want everyone to basically be able to access my apps out in here or I want only localhost for three thousand axis is or only specific domain and of course after adding this one after you go to post menu here you try to do another request if you check the response headers in here you're going to find like a bunch of headers being added by helmet and the cores and all of them actually to protect you from security vulnerabilities and just to make your server as protected as possible now plus button is actually really awesome repository in here I really advise you guys to go ahead and look how to actually read through which is node best practices has more than 9 000 K in here and this actually performs all the best practices in node.js ecosystem from handling servers uh to code styling practices testing error handling so much more it has a lot a lot of stuff a lot of Articles a lot of really really purchase stuff so go ahead and look into this one actually just to improve your skill Sands in node.js and express so anyway guys thanks for watching hope you guys enjoyed and catch you all hopefully in the next ones

Channel: CoderOne

Views: 25,557

Keywords: express, express.js, express JS, express mistakes, learn express, express api, express.js api, master express.js, express.js beginners, Express for beginners, senior vs junior developer, junior, express headers, express cors, express router, express auth, api auth, api mistakes, api junior dev

Id: RtLAwnYJOyQ

Length: 17min 13sec (1033 seconds)

Published: Mon Jul 24 2023