To gauge the performance of our apps, we need to measure the response time of our API.

To do this with our Express app, we can use the response-time package.

Installation

response-time is available as a Node package. We can install it by running:

npm install response-time

Then we can import it by writing:

const responseTime = require('response-time');

responseTime([options])

We can set various options by passing an object into the optional options parameter.

It’ll create a middleware that adds a X-Response-Time header to responses.

The options object takes the following properties:

digits

The digits property is a fixed number of digits to include in the output, which is always in milliseconds. The default is 3.

header

The name of the header to be set. It defaults to X-Response-Time.

suffix

The suffix property is a boolean property to indicate if units of measure should be added to the output. The default value is true.

responseTime(fn)

The function creates a middleware that records the response time of a request and makes it available to our own function fn. fn has the signature (req, res, time) where time is a number in milliseconds.

Examples

Simple Example

We can use the responseTime package without any options or function passed in:

const express = require('express');  
const bodyParser = require('body-parser');  
const responseTime = require('response-time')  
const app = express();  
app.use(bodyParser.json());  
app.use(bodyParser.urlencoded({ extended: true }));

app.use(responseTime());

app.get('/', (req, res) => {  
  res.send('foo');  
});

app.listen(3000);

Then we get a X-Response-Time response header with a value like 0.587ms.

We can check the response header on an HTTP client like Postman.

Passing in Options

We can change the options for the header returned with the response. For example, we can write the following to change the number of digits sent:

const express = require('express');  
const bodyParser = require('body-parser');  
const responseTime = require('response-time')  
const app = express();  
app.use(bodyParser.json());  
app.use(bodyParser.urlencoded({ extended: true }));

app.use(responseTime({  
  digits: 5  
}))

app.get('/', (req, res) => {  
  req.id = 1;  
  res.send('foo');  
});

app.listen(3000);

Then we get a X-Response-Time response header with a value like 0.71987ms.

Passing in Our Own Function

We can pass a function into the responseTime function as follows:

const express = require('express');  
const bodyParser = require('body-parser');  
const responseTime = require('response-time')  
const app = express();  
app.use(bodyParser.json());  
app.use(bodyParser.urlencoded({ extended: true }));

app.use(responseTime((req, res, time) => {  
  console.log(`${req.method} ${req.url} ${time}`);  
}))

app.get('/', (req, res) => {  
  req.id = 1;  
  res.send('foo');  
});

app.listen(3000);

Then we get something like:

GET / 2.9935419999999997

from the console.log.

It’s useful if we want to manipulate the response time data or log it ourselves.

Conclusion

We can get the response time in the response header of a request with the response-time package.

It has a responseTime function which returns a middleware that we can use with the use method of express or express.Router() .

The function can either take an options object and or a function with the req, res, and time parameters to get the request, response, and response time respectively.

To add basic auth capabilities to an Express app, we can use the express-basic-auth package.

With it, we can check for a given username and password in the URL in our protected routes.

In this article, we’ll take a look at how to use it.

How to Install

express-basic-auth is available as a Node package, we can install it by running:

npm install express-basic-auth

Basic Usage

We can use it as follows:

const express = require('express');  
const basicAuth = require('express-basic-auth')  
const app = express();
app.use(basicAuth({  
    users: { 'admin': 'supersecret' }  
}))

app.get('/', (req, res) => {  
  res.send('authorized');  
});

app.listen(3000, () => console.log('server started'));

In the code above, we included the basicAuth middleware from express-basic-auth from in our app.

Then we can call app.use with an object that has the users property with the usernames as the keys and the corresponding passwords as the values.

Then if we make a GET request to a URL like:

https://admin:supersecret@ThistleDarkExponents--five-nine.repl.co

Then we’ll get the authorized response back since the username and password matches what we listed in the object in our app.

Otherwise, we’ll get a 401 response and a configurable body, which is empty by default.

Custom Authorization

We can also pass in our own authorizer function to check for credentials that we want.

We shouldn’t use standard string comparison with == or === when comparing user input with sercet credentials since it’ll make our app vulenrable to timing attacks.

Timing attacks are a side-channel attack where the attacker tries to compromise a system by analyzing the time taken to run cryptographic algorithms.

We should use the safeCompare method provided by the package instead.

Also, we should use bitwise logic operators instead of standard ones for the same reason.

For example, we can use the following:

const express = require('express');  
const basicAuth = require('express-basic-auth')  
const app = express();
app.use(basicAuth({  
  authorizer: (username, password) => {  
    const userMatches = basicAuth.safeCompare(username, 'admin')  
    const passwordMatches = basicAuth.safeCompare(password, 'supersecret')  
    return userMatches & passwordMatches  
  }  
}))

app.get('/', (req, res) => {  
  res.send('authorized');  
});

app.listen(3000, () => console.log('server started'));

In the code above, we have a function that calls safeCompare to match the username and password respectively and then use the AND bitwise operator to combine the 2 to make sure that both are true .

Async Authorization

We can set the authorizeAsync option to true and set a function with a cb parameter for the callback as the authorizer function to check credentials asynchronously:

const express = require('express');  
const basicAuth = require('express-basic-auth')  
const app = express();
app.use(basicAuth({  
  authorizer: (username, password, cb) => {  
    const userMatches = basicAuth.safeCompare(username, 'admin')  
    const passwordMatches = basicAuth.safeCompare(password, 'supersecret')  
    if (userMatches & passwordMatches)  
      return cb(null, true)  
    else  
      return cb(null, false)  
  },  
  authorizeAsync: true,  
}))

app.get('/', (req, res) => {  
  res.send('authorized');  
});

app.listen(3000, () => console.log('server started'));

We return the cb callback call instead of returning the result directly in our authorizer function.

Unauthorized Response Body

We can set the unauthorizedResponse property to a function that returns a response that we want to show when a credential check failed.

For example, we can write:

const express = require('express');  
const basicAuth = require('express-basic-auth')  
const app = express();  
app.use(basicAuth({  
  users: { 'admin': 'supersecret' },  
  unauthorizedResponse: (req) => {  
    return `unauthorized. ip: ${req.ip}`  
  }  
}))  
app.get('/', (req, res) => {  
  res.send('authorized');  
});  
app.listen(3000, () => console.log('server started'));

to return something like:

unauthorized. ip: ::ffff:172.18.0.1

when basic authentication fails.

The function we set unauthorizedResponse to takes the Express request object, so we can use any properties from there in the function.

Challenge

We can make browsers show a popup so that users can enter credentials for authentication by add a challenge: true option to the object.

In addition, we set the realm to identify the system to authenticate against and can be used to save credentials of the challenge by passing a static or a function that gets passed the request object and is expected to return the challenge:

const express = require('express');  
const basicAuth = require('express-basic-auth')  
const app = express();app.use(basicAuth({  
  users: { 'admin': 'supersecret' },  
  challenge: true,  
  realm: 'foo',  
}))

app.get('/', (req, res) => {  
  res.send('authorized');  
});

app.listen(3000, () => console.log('server started'));

With the code above, we should get a dialog box to enter the username and password when we load the / page.

Conclusion

Adding basic auth to an Express app is easy with the express-basic-auth package.

It lets us add a list of valid credentials or use a function to validate credentials.

We can also let users enter the username and password and display custom content when the user is unauthorized.

To conditionally skip a middleware when a condition is met, we can use the express-unless package.

In this article, we’ll take a look at how to use it.

Installation

We can install it by running:

npm i express-unless --save

Usage

After installing it, we can assign the unless function exposed by the express-unless and assign it to the unless property of our middleware functions.

For example, we can write:

const express = require('express');  
const unless = require('express-unless');  
   
const static = express.static(__dirname + '/public');  
static.unless = unless;const app = express();  
app.use(static.unless({ method: 'OPTIONS' }));  
app.listen(3000, () => console.log('server started'));

In the code above, we set the unless property of static to the unless function of the express-unless package.

Then we write:

app.use(static.unless({ method: 'OPTIONS' }));

to exclude the static route from running on OPTIONS requests.

If we’re writing our own middleware, we can assign the unless property of our middleware function as follows:

const express = require('express');  
const unless = require('express-unless');  
   
const static = express.static(__dirname + '/public');
const logHostname = (req, res, next) =>{  
  console.log(req.hostname);  
  next();  
}  
logHostname.unless = unless;const app = express();  
app.use(logHostname.unless({ method: 'OPTIONS' }));  
app.listen(3000, () => console.log('server started'));

In the code above, we defined the logHostman middleware to log the hostname. Then we set the unless property of the function to the unless function exposed in the express-unless package.

Options

In the object that we pass into unless , we can pass in the following options:

• method — this can be a string or an array of strings. If the request method matches then the middleware won’t run.
• path — this can be a string, regex or an array of string or regex. It can also be an array of object which is URL and method key-value pairs. If the request path or path and method match, then the middleware won’t run.
• ext — this is a string or array of strings. If the path ends with those extensions then a middleware won’t run.
• custom — a function that accepts req and returns a boolean. If the function returns true for the given request, then the middleware won’t run.
• useOriginalUrl — this should be a boolean. Defaults to true . If it’s false , the path will match against req.url instead of req.originalUrl .

Advanced Examples

We can exclude calling the express.static middleware when we have the jpg , html , css or .js extensions as follows:

const express = require('express');  
const unless = require('express-unless');  
const url = require('url');  
const static = express.static(__dirname + '/public');
static.unless = unless;
const app = express();  
app.use(static.unless((req) => {  
  const ext = url.parse(req.originalUrl).pathname.substr(-4);  
  return !['.jpg', '.html', '.css', '.js'].includes(ext);  
}));  
app.listen(3000, () => console.log('server started'));

In the code above, we check the extensions of the req.originalUrl property to see if they the request have the extensions listed in the array and skip the static middleware if they’re there.

We can also mix paths and request methods together as follows:

const express = require('express');  
const unless = require('express-unless');
const static = express.static(__dirname + '/public');  
const logHostname = (req, res, next) => {  
  console.log(req.hostname);  
  next();  
}  
logHostname.unless = unless;  
const app = express();  
app.use(logHostname.unless({  
  path: [  
    '/index.html',  
    { url: '/', methods: ['OPTIONS', 'PUT'] }  
  ]  
}));  
app.listen(3000, () => console.log('server started'));

Then we stop the logHostname middleware from running when we go to index.html or / with the PUT or OPTION request methods.

Conclusion

We can stop middleware from running on certain routes or request methods by using the express-unless package.

To use it, we just set the unless function exposed from the package and set it to the unless property of our middleware function.

Then we can exclude routes by using various conditions by checking the URL and/or request method.