Middleware

Q: What does next() do in middleware?

In frameworks like Express, calling next() hands the request to the next middleware or route handler in the chain. If a middleware neither calls next() nor sends a response, the request hangs.

Updated September 29, 20262 min read

In short

Middleware is software that sits between two layers of a system, most often code that runs between an incoming request and the final response in a web server.

What is middleware?

Middleware is a general term for software that connects or sits between other pieces of software. In backend web development, it usually means a function that runs in the middle of handling a request: after the server receives it and before the route handler that produces the final response.

Middleware functions are chained into a pipeline. Each one can read or modify the request, add something to the response, stop the request early (for example, by returning 401 Unauthorized), or pass control to the next function, often by calling next(). Web frameworks such as Express, Koa, ASP.NET Core, Django, and Next.js all use this pattern.

Think of airport security: before you reach your gate, you pass through a ticket check, a security scan, and passport control, and any of them can stop you. Middleware is used the same way for cross-cutting concerns, meaning tasks shared by many routes, such as logging, authentication, parsing JSON bodies, compression, rate limiting, and CORS headers.

The word also has an older, broader meaning in enterprise software, where middleware refers to systems like message brokers, application servers, and integration platforms that connect separate applications. Both meanings share the same idea: a layer in the middle that handles shared work so the pieces on either side don't have to.

Key takeaways

Middleware runs between receiving a request and sending the response.
Multiple middleware functions form a chain that runs in order.
Each one can modify the request, end it early, or pass it on.
Common uses include logging, authentication, body parsing, CORS, and rate limiting.

Example

A logging middleware in Express.jsjavascript

// Log every request, then hand it to the next function in the chain
function logRequests(req, res, next) {
  console.log(`${req.method} ${req.url}`);
  next();
}

app.use(logRequests);    // runs for every request
app.use(express.json()); // built-in middleware that parses JSON bodies

app.get("/hello", (req, res) => {
  res.send("Hello!");
});

Readers ask

What does next() do in middleware?

In frameworks like Express, calling next() hands the request to the next middleware or route handler in the chain. If a middleware neither calls next() nor sends a response, the request hangs.

Is middleware the same as an API?

No. An API is the interface that clients call, while middleware is internal code that processes requests on their way to the code that implements that API.

Does the order of middleware matter?

Yes. Middleware runs in the order it is registered, so a body parser must run before any handler that reads the request body, and authentication must run before protected routes.