HTTP Server

Node.js is purpose-built for network I/O, and its built-in http module lets you create HTTP servers without installing any dependencies. Every request follows the same lifecycle: a client opens a TCP connection, sends an HTTP request, the server emits a request event, and your handler produces an HTTP response.

In production you rarely use raw http directly. Frameworks like Express and Fastify provide routing, middleware, validation, and error handling. But understanding the underlying module is essential: it teaches you how streams, headers, status codes, and keep-alive actually work, which makes debugging framework code far easier.

This guide starts with the low-level API, then moves through routing and body parsing, compares Express and Fastify, and closes with security, testing, performance, and deployment patterns. All examples target Node.js 20+ and use modern ESM syntax.

The node:http module exposes createServer, which returns a server instance. The callback receives an IncomingMessage (the request) and a ServerResponse (the response). Both are streams, which is why Node.js can handle large payloads with minimal memory.

The server is event-driven. It binds to a port with listen, emits request for every HTTP request, and emits error for bind failures or unexpected socket problems. Inspect req.method, req.url, and req.headers to decide what to do.

Once you call res.writeHead, the status and headers are flushed. Prefer setting headers first, then writing the body. If you call res.write before explicitly setting a status, Node.js sends 200 OK automatically and implicit headers are locked.

Routing matches a request URL and method to a handler. The built-in module gives you req.url and req.method as strings. For production, parse the URL once with new URL(req.url, 'http://' + req.headers.host) to get pathname and search params reliably.

HTTP headers are case-insensitive by spec, but Node.js lowercases incoming header names for consistency. Outgoing headers preserve the case you provide. Common request headers to inspect include content-type, content-length, authorization, and accept.

Query parameters live in the URL and are accessible through url.searchParams. They are always strings, so validate and coerce types explicitly. Never trust query input for authorization or filesystem access without sanitization.

Request bodies are streams, not buffers. For JSON APIs, collect chunks, enforce a maximum size, and parse only after the stream ends. This protects against memory exhaustion attacks and malformed payloads.

Backpressure

Backpressure occurs when a producer sends data faster than a consumer can process it. In HTTP this commonly happens when streaming a file to a slow client. Ignoring it causes memory bloat. Use stream.pipe(res) or respect the write return value and the drain event.

Serving static files from disk is a common requirement. The safest approach uses path.resolve and path.join to prevent directory traversal, sets correct MIME types, and streams the file rather than reading it into memory.

Express wraps the built-in HTTP server with a middleware pipeline: every request passes through matched middleware in registration order before reaching a route handler. Middleware can modify the request, end the response, or pass control with next().

Async route handlers in Express require care. If a rejected promise is not caught, the request hangs. Wrap async handlers in a utility or use Express 5, which automatically forwards promise rejections to the error middleware.

Fastify is a performance-focused framework built around JSON schemas, encapsulation, and hooks. It automatically serializes responses using the schema you provide, which doubles as documentation and a runtime optimization. Routes, plugins, and decorators are encapsulated by default.

Hooks run at specific points in the lifecycle. Use onRequest for authentication, preHandler for validation, onSend for response transformation, and onResponse for metrics. If a hook throws, Fastify routes the error to the default error handler.

Express offers unmatched ecosystem compatibility and a familiar middleware model, but it requires external validation and manual async error handling in version 4. Fastify provides built-in JSON-schema validation, encapsulated plugins, native async/await support, and higher throughput in most benchmarks because it compiles response serializers.

HTTP servers sit at the edge of your application and are the first target for attackers. Defense in depth means layering controls: secure headers, input validation, rate limiting, least-privilege secrets, and dependency scanning. A single missing header or unvalidated input can expose your entire stack.

Input validation should happen as close to the edge as possible. Use Zod, Joi, or JSON schemas to reject malformed data before it reaches business logic. Never use user input directly in file paths, shell commands, SQL queries, or outbound requests.

Node.js 20 ships with a built-in test runner under node:test and assertion module node:assert/strict. It supports subtests, hooks, mocking, and coverage via --experimental-test-coverage. For HTTP servers, Supertest binds to an ephemeral port and lets you assert on status, headers, and body.

For framework apps, export the configured app without calling listen. Tests can then start and stop the server independently. Use separate test databases, transactional fixtures, or in-memory fakes to keep tests deterministic and fast.

Node.js is single-threaded, so a long-running computation blocks the event loop and stalls all concurrent requests. Use the cluster module to spawn one worker per CPU core, or move heavy work to worker_threads for CPU-bound tasks.

Monitor event loop lag with perf_hooks, profile CPU with node --prof, and analyze with clinic.js. Memory leaks often come from accumulating closures, uncached large objects, or forgetting to remove event listeners. Cache aggressively at the edge, but never cache user-specific data in shared caches.

Production deployment requires process management, health checks, graceful shutdown, containerization, and environment isolation. PM2 and Docker are the two most common tools in the Node.js ecosystem.

A production Dockerfile should be multi-stage, use a minimal base image, run as a non-root user, and only copy the files needed to run. Distroless images reduce the attack surface further but are harder to debug.