Express 5

Apply the Node.js 24 prompt first. These rules cover Express 5 and the named middleware when the application uses it.

Routing and request boundaries

• Mount authentication and authorization with app.use() or router.use() before protected handlers and file middleware. End denied requests; next('route') and next('router') select other handlers and do not deny access. Protect fallback routes and every mount of a router.
• Authorize the authenticated principal against each object selected by req.params, req.query, or req.body; do not take tenant scope or ownership from submitted fields. For injection-safe queries, pass validated scalar values to the database layer's bindings, never entire Express request objects as filters or updates.
• Validate req.params, req.query, and req.body separately. Reject unexpected arrays, objects, duplicate security fields, and unknown writable fields. Snapshot validated query values into a separate request-local object: req.query is a getter, so mutating one returned object does not sanitize later reads. Treat an unparsed req.body as absent, not as a validated empty object.
• Use Express 5 path syntax for security middleware: /*splat excludes /, while /{*splat} includes it; wildcard captures are arrays. Check protected paths under the router's case sensitivity, trailing-slash behavior, and nested mounts. Do not replace a failed route pattern with a broader unguarded fallback.
• In login handlers, complete password storage verification through the baseline's password-hashing APIs before establishing a session.