ExisJS

Middleware (exisjs/middleware)

ExisJS ships with an optimized suite of core middleware. Rather than relying on heavy external dependencies, ExisJS implements security and utility middleware directly.

All middlewares can be applied globally in server.ts, folder-wide in boundary.ts, or locally on specific controllers/routes.

How to Apply Middleware

ExisJS provides first-class support for both Object-Oriented and Functional middleware application.

Class-Based (OOP)

src/http/users/route.ts
import { Controller, Get, Use } from 'exisjs/decorators'import { ipFilter } from 'exisjs/middleware'
@Controller('/users')@Use(ipFilter({ allow: ['192.168.1.0/24'] })) // Applies to entire controllerexport default class UserController {  @Get('/stats')  getStats() {    return { users: 100 }  }}

Functional

src/http/users/route.ts
import { controller, route } from 'exisjs/router'import { ipFilter } from 'exisjs/middleware'
export default controller({  middleware: [ipFilter({ allow: ['192.168.1.0/24'] })],
  getStats: route.get('/stats', {    async handle() {      return { users: 100 }    }  })})

Security Middleware

helmet(options?)

Sets 14+ strict security headers (HSTS, CSP, XSS Protection, No Sniff, Frameguard) to protect your application.

import { helmet } from 'exisjs/middleware'
app.use(helmet())

csrf(options)

Implements the Signed Double Submit Cookie pattern for Cross-Site Request Forgery (CSRF) protection.

timeout(ms)

Automatically times out requests that exceed the specified milliseconds, returning a 503 response.

hpp()

HTTP Parameter Pollution protection.

dbSanitize(options?)

Sanitizes query and body payloads from NoSQL injection attempts.

Traffic & Reliability Middleware

rateLimit(options?)

High-performance rate limiter running in-memory and off-heap via Rust native bindings (NativeRateLimiter).

DEFAULT

[!NOTE] Core rate limiting is scoped to in-memory native execution. Distributed multi-instance Redis rate limiting moves to @exisjs/cache.

import { rateLimit } from 'exisjs/middleware'
app.use(rateLimit({  windowMs: 60000,  max: 100}))

idempotent(options?)

Caches responses based on the Idempotency-Key header into off-heap native memory to prevent duplicate mutations.

import { idempotent } from 'exisjs/middleware'
export const handlePayment = [  idempotent({ ttlMs: 86400000 }),  async (req, res) => { ... }]

dedupe(options?)

Prevents duplicate identical in-flight requests from being computed simultaneously.

backpressure(options?)

Monitors the Node.js Event Loop delay in real-time, shedding load when overloaded.

ipFilter(options)

Fast CIDR-based IP whitelist/blacklist filter.

Utility Middleware

cors(options?)

Cross-Origin Resource Sharing handler supporting preflight, dynamic origin matching, and credential headers.

requestId()

Injects a unique X-Request-Id into every incoming request and outgoing response header.

requestLogger(options?)

High-performance request logger powered by Pino.

serveStatic(root, options?)

Static file server supporting streaming and caching headers.

Edit this page on GitHub