Skip to content
    SeaCode
    Learning tracksCode ArenaWorkshops & EventsInstructors
    Log inSign up
    NODENode.js

    Runtime and core tooling

    • What is Node.js?
    • CommonJS and ES modules
    • npm and package.json
    • process and command-line apps

    Async I/O and events

    • Event loop: callbacks to async/await
    • Files and paths with fs/promises
    • EventEmitter
    • Streams and backpressure

    HTTP and APIs

    • Your first HTTP server
    • Routing and JSON bodies
    • Build a tiny router and middleware chain
    • REST: resources and status codes
    • Validation and error handling

    Production: security, testing and deployment

    • Authentication basics with crypto
    • Configuration and environment secrets
    • Testing with assert and node:test
    • API security fundamentals
    • Project: tasks REST API and deployment
    Node.js

    HTTP and APIs · Lesson 10 of 18

    Routing and JSON bodies

    Choose handlers by method and pathname, and read bounded request bodies.

    13 minutes2 games

    A route is a (method, pathname) pair. Use new URL(req.url, base) to separate pathname from query. A Node request body is a stream: collect chunks with a size limit, then JSON.parse inside try/catch. GET normally has no body, while POST creates a resource.

    method + URL

    Router matches

    Read/validate JSON

    handler + status

    Node.js
    const http = require("node:http")
    const server = http.createServer((req, res) => {
      const url = new URL(req.url, "http://localhost")
      res.setHeader("content-type", "application/json")
      if (req.method === "GET" && url.pathname === "/health") {
        res.end(JSON.stringify({ ok: true }))
      } else {
        res.statusCode = 404
        res.end(JSON.stringify({ error: "not found" }))
      }
    })
    server.listen(0, async () => {
      const base = "http://127.0.0.1:" + server.address().port
      const a = await fetch(base + "/health")
      const b = await fetch(base + "/missing")
      console.log(a.status, (await a.json()).ok, b.status)
      server.close()
    })

    A readJson(req) helper should reject oversized bodies with 413, malformed JSON with 400, and check content type. Match the pathname rather than the whole query string. Parameters such as /tasks/42 need parsing, conversion and validation.

    Important

    Never buffer a body without a limit; an attacker can send gigabytes and exhaust memory. Enforce the limit while chunks arrive, terminate oversized requests, and set timeouts at both reverse proxy and server.

    Quick question

    What status should malformed client JSON receive?

    Interview question

    Why use new URL instead of manual splitting?

    Exercise

    Write route(method,path) returning list for GET /tasks, create for POST /tasks, otherwise not-found. Print all three.

    Expected output: list create not-found

    Node.js
    function route(method, path) {
    
    }
    console.log(route("GET", "/tasks"), route("POST", "/tasks"), route("GET", "/x"))

    Learn more from

    • Node.js: Anatomy of an HTTP transactionnodejs.org
    • MDN: URLdeveloper.mozilla.org

    Played 0 of 2 games

    Sign in to save your progress and earn XP.

    PreviousYour first HTTP serverNextBuild a tiny router and middleware chain
    SeaCode

    Learn to code for real, online or at our branch in front of Cairo University, Giza.

    Learn

    • All courses
    • Interactive tutorials
    • Interview practice problems
    • Mock interview
    • Learning tracks
    • Code Arena
    • Workshops & Events
    • Knowledge library
    • Team projects

    Your account

    • Log in
    • Sign up
    • Learning plan
    • Certificates
    • Site map

    Contact us

    • WhatsApp
    • 010 9094 1104
    • In front of Cairo University, Giza

    © 2026 SeaCode. All rights reserved.