Installs into .claude/skills of the current project.
Are you the author of Express?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/diegosouzapw-express)
---
name: express
description: Express.js server best practices including middleware, error handling, and security.
globs: ["**/server.js", "**/app.js", "**/routes/**/*.js", "**/middleware/**/*.js"]
priority: 85
tags: ["framework"]
---
# Express.js Best Practices
## Project Structure
- src/routes/ for route handlers
- src/middleware/ for middleware
- src/controllers/ for business logic
- src/models/ for data models
- src/utils/ for utilities
## Middleware
- Use helmet for security headers
- Use cors for CORS handling
- Use morgan for logging
- Use compression for gzip
- Use express.json() for body parsing
- Order middleware correctly
## Error Handling
- Use async error wrapper or express-async-errors
- Centralized error handler middleware
- Send appropriate status codes
- Log errors with context
- Never expose stack traces in production
## Security
- Validate all inputs with Joi/Zod
- Sanitize user data
- Use rate limiting
- Implement CSRF protection
- Use secure session config
## Performance
- Use caching (Redis)
- Implement pagination
- Use streaming for large responses
- Enable gzip compression
- Use connection pooling for databases
