Develop Reference

When I'm making a POST requestion in my login page [duplicate]

I'm fairly new to Node.js and I am having some issues.
I am using Node.js 4.10 and Express 2.4.3.
When I try to access http://127.0.0.1:8888/auth/facebook, i'll be redirected to http://127.0.0.1:8888/auth/facebook_callback.
I then received the following error:
Error: Can't render headers after they are sent to the client.
at ServerResponse.<anonymous> (http.js:573:11)
at ServerResponse._renderHeaders (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/patch.js:64:25)
at ServerResponse.writeHead (http.js:813:20)
at /home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect-auth/lib/auth.strategies/facebook.js:28:15
at /home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect-auth/lib/index.js:113:13
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect-auth/lib/strategyExecutor.js:45:39)
at [object Object].pass (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect-auth/lib/authExecutionScope.js:32:3)
at [object Object].halt (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect-auth/lib/authExecutionScope.js:29:8)
at [object Object].redirect (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect-auth/lib/authExecutionScope.js:16:8)
at [object Object].<anonymous> (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect-auth/lib/auth.strategies/facebook.js:77:15)
Error: Can't set headers after they are sent.
at ServerResponse.<anonymous> (http.js:527:11)
at ServerResponse.setHeader (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/patch.js:50:20)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:162:13)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:195:11)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:150:23)
at param (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/middleware/router.js:189:13)
at pass (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/middleware/router.js:191:10)
at Object.router [as handle] (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/middleware/router.js:197:6)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:198:15)
at Object.auth [as handle] (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect-auth/lib/index.js:153:7)
Error: Can't set headers after they are sent.
at ServerResponse.<anonymous> (http.js:527:11)
at ServerResponse.setHeader (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/patch.js:50:20)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:162:13)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:207:9)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:150:23)
at param (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/middleware/router.js:189:13)
at pass (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/middleware/router.js:191:10)
at Object.router [as handle] (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/middleware/router.js:197:6)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:198:15)
at Object.auth [as handle] (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect-auth/lib/index.js:153:7)
Error: Can't set headers after they are sent.
at ServerResponse.<anonymous> (http.js:527:11)
at ServerResponse.setHeader (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/patch.js:50:20)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:162:13)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:150:23)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:207:9)
at Object.auth [as handle] (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect-auth/lib/index.js:153:7)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:198:15)
at HTTPServer.handle (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:211:3)
at Object.handle (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:105:14)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:198:15)
Error: Can't set headers after they are sent.
at ServerResponse.<anonymous> (http.js:527:11)
at ServerResponse.setHeader (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/patch.js:50:20)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:162:13)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:150:23)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:207:9)
at HTTPServer.handle (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:211:3)
at Object.handle (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:105:14)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:198:15)
at /home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/middleware/session.js:323:9
at /home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/middleware/session.js:338:9
node.js:134
throw e; // process.nextTick error, or 'error' event on first tick
^
Error: Can't set headers after they are sent.
at ServerResponse.<anonymous> (http.js:527:11)
at ServerResponse.setHeader (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/patch.js:50:20)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:162:13)
at next (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/http.js:207:9)
at /home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/middleware/session.js:323:9
at /home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/middleware/session.js:338:9
at Array.<anonymous> (/home/eugene/public_html/all_things_node/projects/fb2/node_modules/connect/lib/middleware/session/memory.js:57:7)
at EventEmitter._tickCallback (node.js:126:26)
The following is my code:
var fbId= "XXX";
var fbSecret= "XXXXXX";
var fbCallbackAddress= "http://127.0.0.1:8888/auth/facebook_callback"
var cookieSecret = "node"; // enter a random hash for security
var express= require('express');
var auth = require('connect-auth')
var app = express.createServer();
app.configure(function(){
app.use(express.bodyParser());
app.use(express.methodOverride());
app.use(express.cookieParser());
app.use(express.session({secret: cookieSecret}));
app.use(auth([
auth.Facebook({
appId : fbId,
appSecret: fbSecret,
callback: fbCallbackAddress,
scope: 'offline_access,email,user_about_me,user_activities,manage_pages,publish_stream',
failedUri: '/noauth'
})
]));
app.use(app.router);
});
app.get('/auth/facebook', function(req, res) {
req.authenticate("facebook", function(error, authenticated) {
if (authenticated) {
res.redirect("/great");
console.log("ok cool.");
console.log(res['req']['session']);
}
});
});
app.get('/noauth', function(req, res) {
console.log('Authentication Failed');
res.send('Authentication Failed');
});
app.get('/great', function( req, res) {
res.send('Supercoolstuff');
});
app.listen(8888);
May I know what is wrong with my code?

The res object in Express is a subclass of Node.js's http.ServerResponse (read the http.js source). You are allowed to call res.setHeader(name, value) as often as you want until you call res.writeHead(statusCode). After writeHead, the headers are baked in and you can only call res.write(data), and finally res.end(data).
The error "Error: Can't set headers after they are sent." means that you're already in the Body or Finished state, but some function tried to set a header or statusCode. When you see this error, try to look for anything that tries to send a header after some of the body has already been written. For example, look for callbacks that are accidentally called twice, or any error that happens after the body is sent.
In your case, you called res.redirect(), which caused the response to become Finished. Then your code threw an error (res.req is null). and since the error happened within your actual function(req, res, next) (not within a callback), Connect was able to catch it and then tried to send a 500 error page. But since the headers were already sent, Node.js's setHeader threw the error that you saw.
Comprehensive list of Node.js/Express response methods and when they must be called:
Response must be in Head and remains in Head:
res.writeContinue()
res.statusCode = 404
res.setHeader(name, value)
res.getHeader(name)
res.removeHeader(name)
res.header(key[, val]) (Express only)
res.charset = 'utf-8' (Express only; only affects Express-specific methods)
res.contentType(type) (Express only)
Response must be in Head and becomes Body:
res.writeHead(statusCode, [reasonPhrase], [headers])
Response can be in either Head/Body and remains in Body:
res.write(chunk, encoding='utf8')
Response can be in either Head/Body and becomes Finished:
res.end([data], [encoding])
Response can be in either Head/Body and remains in its current state:
res.addTrailers(headers)
Response must be in Head and becomes Finished:
return next([err]) (Connect/Express only)
Any exceptions within middleware function(req, res, next) (Connect/Express only)
res.send(body|status[, headers|status[, status]]) (Express only)
res.attachment(filename) (Express only)
res.sendfile(path[, options[, callback]]) (Express only)
res.json(obj[, headers|status[, status]]) (Express only)
res.redirect(url[, status]) (Express only)
res.cookie(name, val[, options]) (Express only)
res.clearCookie(name[, options]) (Express only)
res.render(view[, options[, fn]]) (Express only)
res.partial(view[, options]) (Express only)

Some of the answers in this Q&A are wrong. The accepted answer is also not very "practical", so I want to post an answer that explains things in simpler terms. My answer will cover 99% of the errors I see posted over and over again. For the actual reasons behind the error take a look at the accepted answer.
HTTP uses a cycle that requires one response per request. When the client sends a request (e.g. POST or GET) the server should only send one response back to it.
This error message:
Error: Can't set headers after they are sent.
usually happens when you send several responses for one request. Make sure the following functions are called only once per request:
res.json()
res.send()
res.redirect()
res.render()
(and a few more that are rarely used, check the accepted answer)
The route callback will not return when these res functions are called. It will continue running until it hits the end of the function or a return statement. If you want to return when sending a response you can do it like so: return res.send().
Take for instance this code:
app.post('/api/route1', function(req, res) {
console.log('this ran');
res.status(200).json({ message: 'ok' });
console.log('this ran too');
res.status(200).json({ message: 'ok' });
}
When a POST request is sent to /api/route1 it will run every line in the callback. A Can't set headers after they are sent error message will be thrown because res.json() is called twice, meaning two responses are sent.
Only one response can be sent per request!
The error in the code sample above was obvious. A more typical problem is when you have several branches:
app.get('/api/company/:companyId', function(req, res) {
const { companyId } = req.params;
Company.findById(companyId).exec((err, company) => {
if (err) {
res.status(500).json(err);
} else if (!company) {
res.status(404).json(); // This runs.
}
res.status(200).json(company); // This runs as well.
});
}
This route with attached callback finds a company in a database. When doing a query for a company that doesn't exist we will get inside the else if branch and send a 404 response. After that, we will continue on to the next statement which also sends a response. Now we have sent two responses and the error message will occur. We can fix this code by making sure we only send one response:
.exec((err, company) => {
if (err) {
res.status(500).json(err);
} else if (!company) {
res.status(404).json(); // Only this runs.
} else {
res.status(200).json(company);
}
});
or by returning when the response is sent:
.exec((err, company) => {
if (err) {
return res.status(500).json(err);
} else if (!company) {
return res.status(404).json(); // Only this runs.
}
return res.status(200).json(company);
});
A big sinner is asynchronous functions. Take the function from this question, for example:
article.save(function(err, doc1) {
if (err) {
res.send(err);
} else {
User.findOneAndUpdate({ _id: req.user._id }, { $push: { article: doc._id } })
.exec(function(err, doc2) {
if (err) res.send(err);
else res.json(doc2); // Will be called second.
})
res.json(doc1); // Will be called first.
}
});
Here we have an asynchronous function (findOneAndUpdate()) in the code sample. If there are no errors (err) findOneAndUpdate() will be called. Because this function is asynchronous the res.json(doc1) will be called immediately. Assume there are no errors in findOneAndUpdate(). The res.json(doc2) in the else will then be called. Two responses have now been sent and the Can't set headers error message occurs.
The fix, in this case, would be to remove the res.json(doc1). To send both docs back to the client the res.json() in the else could be written as res.json({ article: doc1, user: doc2 }).

I ran into this error as well for a while. I think (hope) I've wrapped my head around it, wanted to write it here for reference.
When you add middleware to connect or express (which is built on connect) using the app.use method, you're appending items to Server.prototype.stack in connect (At least with the current npm install connect, which looks quite different from the one github as of this post). When the server gets a request, it iterates over the stack, calling the (request, response, next) method.
The problem is, if in one of the middleware items writes to the response body or headers (it looks like it's either/or for some reason), but doesn't call response.end() and you call next() then as the core Server.prototype.handle method completes, it's going to notice that:
there are no more items in the stack, and/or
that response.headerSent is true.
So, it throws an error. But the error it throws is just this basic response (from the connect http.js source code:
res.statusCode = 404;
res.setHeader('Content-Type', 'text/plain');
res.end('Cannot ' + req.method + ' ' + req.url);
Right there, it's calling res.setHeader('Content-Type', 'text/plain');, which you are likely to have set in your render method, without calling response.end(), something like:
response.setHeader("Content-Type", "text/html");
response.write("<p>Hello World</p>");
The way everything needs to be structured is like this:
Good Middleware
// middleware that does not modify the response body
var doesNotModifyBody = function(request, response, next) {
request.params = {
a: "b"
};
// calls next because it hasn't modified the header
next();
};
// middleware that modify the response body
var doesModifyBody = function(request, response, next) {
response.setHeader("Content-Type", "text/html");
response.write("<p>Hello World</p>");
response.end();
// doesn't call next()
};
app.use(doesNotModifyBody);
app.use(doesModifyBody);
Problematic Middleware
var problemMiddleware = function(request, response, next) {
response.setHeader("Content-Type", "text/html");
response.write("<p>Hello World</p>");
next();
};
The problematic middleware sets the response header without calling response.end() and calls next(), which confuses connect's server.

I had this same issue and realised it was because I was calling res.redirect without a return statement, so the next function was also being called immediately afterwards:
auth.annonymousOnly = function(req, res, next) {
if (req.user) res.redirect('/');
next();
};
Which should have been:
auth.annonymousOnly = function(req, res, next) {
if (req.user) return res.redirect('/');
next();
};

Lots of people hit this error. It's a confusing this with async processing. Most likely some of your code is setting headers in the first tick and then you are running an async callback in a future tick. In between, the response header gets sent, but then further headers (like a 30X redirect) try to add extra headers, but it's too late since the response header has already been transmitted.
I'm not sure exactly what's causing your error, but look at any callbacks as potential areas to investigate.
One easy tip to simplify your code. Get rid of app.configure() and just call app.use directly in your top level scope.
See also the everyauth module, which does Facebook and a dozen or so other 3rd party authentication providers.

This type of error you will get when you pass statements after sending a response.
For example:
res.send("something response");
console.log("jhgfjhgsdhgfsdf");
console.log("sdgsdfhdgfdhgsdf");
res.send("sopmething response");
Will result in the error you are seeing, because once the response has been sent, the following res.send will not be executed.
If you want do anything, you should do it before sending the response.

error find by itself after a RND :
1) my error code :
return res.sendStatus(200).json({ data: result });
2) my success code
return res.status(200).json({ data: result });
the difference is that i used sendStatus() instead of status().

I boiled my head over this issue and it has happened due to a careless mistake on handling the callbacks. non returned callbacks cause the response to be set twice.!
My program had a code which validate request and query the DB. after validating if error is there, I was calling back the index.js with the validation errors .
And if validation passes it goes ahead and hit the db with success/failure.
var error = validateRequestDetails("create",queryReq);
if (error)
callback(error, null);
else
some code
callback(null, success);
What was happening is : Incase validation fails the callback get called and response get set. But not returned. So it still continues the method goes to db and hit success/failure . It calls the same callback again causing the response to be set twice now.
So solution is simple, you need to 'return' the callback so that the method don't continue executing, once the error has occurred and hence set the response object once
var error = validateRequestDetails("create",queryReq);
if (error)
callback(error, null);
return;
else
some code
callback(null, success);

I simply add the return keyword like:
return res.redirect("/great"); and it worked!

This error happens when you send 2 responses. For example :
if(condition A)
{
res.render('Profile', {client:client_});
}
if (condition B){
res.render('Profile', {client:client_});
}
}
Imagine if for some reason condition A and B are true so in the second render you'll get that error

Sometimes you may get this error when you try to call next() function after res.end or res.send , try to delete if you have next() after res.send or res.end in your function.
Note: here next() means after responding to the client with your response(i.e res.send or res.end) you are still trying to execute some code to respond again so it is not legal.
Example :
router.get('/',function (req,res,next){
res.send("request received");
next(); // this will give you the above exception
});
remove next() from above function and it will work.

If you are using callback functions use return after the err block. This is one of the scenarios in which this error can happen.
userModel.createUser(data, function(err, data) {
if(err) {
res.status = 422
res.json(err)
return // without this return the error can happen.
}
return res.json(data)
})
Tested on Node version v10.16.0 and express 4.16.4

there is something else that cause this error and it is when you do not add return keyword in front of res.send, res.json, etc...

Please check if your code is returning multiple res.send() statements for a single request. Like when I had this issue....
I was this issue in my restify node application. The mistake was that
switch (status) {
case -1:
res.send(400);
case 0:
res.send(200);
default:
res.send(500);
}
I was handling various cases using switch without writing break. For those little familiar with switch case know that without break, return keywords. The code under case and next lines of it will be executed no matter what. So even though I want to send single res.send, due to this mistake it was returning multiple res.send statements, which prompted
error: can't set headers after they are sent to the client.
Which got resolved by adding this or using return before each res.send() method like return res.send(200)
switch (status) {
case -1:
res.send(400);
break;
case 0:
res.send(200);
break;
default:
res.send(500);
break;
}

In my case it was a 304 response (caching) that was causing the issue.
Easiest solution:
app.disable('etag');
Alternate solution here if you want more control:
http://vlasenko.org/2011/10/12/expressconnect-static-set-last-modified-to-now-to-avoid-304-not-modified/

For anyone that's coming to this and none of the other solutions helped, in my case this manifested on a route that handled image uploading but didn't handle timeouts, and thus if the upload took too long and timed out, when the callback was fired after the timeout response had been sent, calling res.send() resulted in the crash as the headers were already set to account for the timeout.
This was easily reproduced by setting a very short timeout and hitting the route with a decently-large image, the crash was reproduced every time.

In my case this happened with React and postal.js when I didn't unsubscribe from a channel in the componentWillUnmount callback of my React component.

Just leaned this. You can pass the responses through this function:
app.use(function(req,res,next){
var _send = res.send;
var sent = false;
res.send = function(data){
if(sent) return;
_send.bind(res)(data);
sent = true;
};
next();
});

This happens when response was delivered to client and again you are trying to give response. You have to check in your code that somewhere you are returning response to client again which causes this error. Check and return response once when you want to return.

Please search if in your app.get to not set status before res.send("your result");
I just removed :
res.sendStatus(200);
and response works after that !!!
res.send("your result");

A newer version of Node supports res.headersSent boolean expression. You can use it to validate whether you already sent a response:
if (!res.headersSent) // if doesn't sent yet
res.status(200).send({ "message": "This is a message" })
Note! Although this works and answers the question, it's not the right way to solve the problem, and is not recommended!
Sending a response more than once indicates that you have a problem in your code that should be fixed (It's the same as using two return statements, one after another, in your function. it's a bug).

Add this middlware and it will work
app.use(function(req,res,next){
var _send = res.send;
var sent = false;
res.send = function(data){
if(sent) return;
_send.bind(res)(data);
sent = true;
};
next();
});

If you din't get help from above : for noobs
The reason behind this error is sending request multiple times let us understand from some cases:-
1. `
module.exports = (req,res,next)=>{
try{
const decoded = jwt.verify(req.body.token,"secret");
req.userData = decoded;
next();
}catch(error){
return res.status(401).json({message:'Auth failed'});
}
next();
}
`
in the above calling next() twice will raise an error
router.delete('/:orderId', (req, res, next) => {
Order.remove({_id:req.params.orderId},(err,data)=>{
if(err){
**res.status(500).json(err);**
}else{
res.status(200).json(data);
}
*res.status(200).json(data);*
})
})
here respond is send twice check whether you already sent a response

It is very likely that this is more of a node thing, 99% of the time it's a double callback causing you to respond twice, or next()ing twice etc, damn sure. It solved my problem was using next() inside a loop. Remove the next() from the loop or stop calling it more than one times.

If you uses two of res.end() function in one api call, this error shows
for example
app.post("/auth", function (request, res) {
var username = request.body.username;
var password = request.body.password;
if (username && password) {
let sql =
"SELECT username, worker_name, worker_surname, id FROM workers where username = ? AND password=?";
con.query(sql, [username, password], function (error, results, fields) {
if (results.length > 0) {
res.status(200).send(results);
res.end();
}
res.status(404).send("Incorrect Username and/or Password!");
});
} else {
res.send("Please enter Username and Password!");
}
res.end();
});

sometimes only writing
res.status(200).json({success: 'user authenticated');
is not enough.
For hours , i found we have to return return response sometimes.
Like this
return res.status(200).json({success: 'user authenticated');
so that It can terminate whenever in some conditional statement and doesn't run other .

The problem was exist from /auth/facebook route to make things ease to understand, once that you sent a response already from the client, you must NOT set any other functions below for next successor block, it is also related on being Synchronous of JavaScript,
for deep understanding, it is looks like this code;
async function getRequest(){
let data = await API.get();
return data;
let json = data.json(); // will not read this line
}
on your case, console.log("ok cool."); and console.log(res['req']['session']) must be put before res.redirect("/great")
Hope it make sense, Welcome :)

I had the same issue. For me i had 2 res.json(event) was giving this error to me.
res.json(savedEvent);
res.json({ event });
We should pass only single response will work.
res.json(event);

I got a similar error when I tried to send response within a loop function. The simple solution was to move the
res.send('send response');
out of the loop since you can only send response header once.
https://www.tutorialspoint.com/nodejs/nodejs_response_object.htm

Check your code. For me, I used res.status twice in the same if statement. First one set the header status and the second one tried to change it, which caused the problem.

Unhandled Error in Node JS Application

I have unhandled piece of code in my NodeJS apps data layer that connects to DB. I am explicitly generating error in my code, at the same time not catching it. This is:
AdminRoleData.prototype.getRoleByRoleId = function (params) {
var connection = new xtrDatabaseConnection();
var query = "CALL role_getRoleByRoleId(:p_RoleId)";
var replacements = { p_RoleId: params.roleId };
replacements = null;
return connection.executeQuery(query, Sequelize.QueryTypes.RAW, replacements);
}
replacements = null; this is where i am generating error. No error handling at the moment here. I want to capture these sort of unhandled errors in my application. And want to log them on to file as unhandled exceptions or errors.
process.on('uncaughtException', (err) => {
logger.log('whoops! There was an uncaught error', err);
// do a graceful shutdown,
// close the database connection etc.
process.exit(1);
});
My question is that my "uncaughtException" is not getting called. Any help ? Or best practices in such scenarios. Or to catch them globally at some centralized place.

If you are using express, you would first define all your routes as:
app.use('/api/users', users);
app.use('/api/accounts', accounts);
...
Then you could catch the 404 errors like so:
app.use(function(req, res, next) {
console.log("A request triggered 404");
next(err);
});
Finally the block, to catch all errors:
// error handler
app.use(function(err, req, res, next) {
console.log(err.message);
res.status(err.status || 500);
res.render('error');
});
Note: The order of the functions is important. For example if you put the 404 handler before the other routes then all you responses will be 404.
Node will traverse the routes in the order in which you declare them until it finds a match.

simply put the code inside a try-catch block and log them ....
try {
//your code that might cause an error to occur
}catch (e){
console.log("ERROR:" + e.toString());
}

throw error versus normal return in express

I know how to write simple API using node.js (express). But now I'm confused and couldn't differentiate this two block of code
if(err){ return res.status(500).json(err) }
return res.json(result)
versus
if(err) { throw new Error(err) }
return res.json(result)
What is the standard for a API response? I simply return 2 property, like
if(err){ return res.json({ status: false, msg: 'user password is incorrect }) }
return ({ status: true, msg: result.token })
What's wrong with my approach and why we should use throw?

You don't generally want to throw an error in Express at all, because unless it's caught it will crash the process without giving your user warning, and it's not easy to catch the error and maintain the request context to do so otherwise.
Instead the choice in an Express handler should be between directly returning an error response (as in your example) and calling next(err). In my apps I always do the latter, because it lets me set up error handling middlware to always and consistently handle the various problem cases.
Example below:
app.get('/something', (req, res, next) => {
// whatever database call or the like
Something.find({ name: 'something'}, (err, thing) => {
// some DB error, we don't know what.
if (err) return next(err);
// No error, but thing wasn't found
// In this case, I've defined a NotFoundError that extends Error and has a property called statusCode set to 404.
if (!thing) return next(new NotFoundError('Thing was not found'));
return res.json(thing);
});
});
Then some middleware for handling errors like so:
app.use((err, req, res, next) => {
// log the error; normally I'd use debug.js or similar, but for simplicity just console in this example
console.error(err);
// Check to see if we have already defined the status code
if (err.statusCode){
// In production, you'd want to make sure that err.message is 'safe' for users to see, or else use a different value there
return res.status(err.statusCode).json({ message: err.message });
}
return res.status(500).json({ message: 'An error has occurred, please contact the system administrator if it continues.' });
});
Note that nearly everything in Express is done through middleware.

Can't set headers after they are sent error while trying to maintain user session for a test with chai request agent

We are currently struggling with a Uncaught Error: Can't set headers after they are sent. error message when trying to chain a user sign in into a test with chai-http.
The test signs in as a user which already exists in the database via our API and then should attempts to GET all items from an existing route. Our current test is below which mirrors very closely the example given on the Chai-HTTP documentation http://chaijs.com/plugins/chai-http/#retaining-cookies-with-each-request.
it('should return all notes on /api/notes GET', function (done) {
agent
.post('/users/register')
.send(user)
.then(function() {
return agent
.get('/api/notes')
.end(function (err, res) {
// expectations
done();
});
});
});
Our stack trace
Uncaught Error: Can't set headers after they are sent.
at ServerResponse.OutgoingMessage.setHeader (_http_outgoing.js:346:11)
at ServerResponse.header (node_modules/express/lib/response.js:718:10)
at ServerResponse.send (node_modules/express/lib/response.js:163:12)
at ServerResponse.json (node_modules/express/lib/response.js:249:15)
at app/routes/usersRouter.js:16:29
at node_modules/passport/lib/middleware/authenticate.js:236:29
at node_modules/passport/lib/http/request.js:51:48
at pass (node_modules/passport/lib/authenticator.js:287:14)
at Authenticator.serializeUser (node_modules/passport/lib/authenticator.js:289:5)
at IncomingMessage.req.login.req.logIn (node_modules/passport/lib/http/request.js:50:29)
at Strategy.strategy.success (node_modules/passport/lib/middleware/authenticate.js:235:13)
at verified (node_modules/passport-local/lib/strategy.js:83:10)
at InternalFieldObject.ondone (node_modules/passport-local-mongoose/lib/passport-local-mongoose.js:149:24)
This is the function being called on our users router which seems to be raising the error (not raised manually, just raised when using chai)
router.post('/register', function(req, res) {
User.register(new User({ username : req.body.username }), req.body.password, function(err, user) {
if (err) {
res.status(500).json({info: err});
}
passport.authenticate('local')(req, res, function () {
res.status(200).json({info: "success"});
});
});
});
Manually testing this functionality works correctly, the issue seems to purely be down to our test and how it is interacting with passport.
Does anyone have any suggestions or pointers which could be of help?

Is there an err object being passed in the User.register callback? If so, try putting return res.status(500).json({info: err}); so that the passport code will not run. The return will exit the function and will not attempt to set the headers twice.

This all comes back to two different pieces of code both answering the request (res.send or res.json).
Essentially there are two possibilities:
1. Passport is using the res object to answer the request, before you do. Check the docs on how this should be done.
2. You get an error and since you have a bug with a missing return in the error handler the res object is set twice.

This is a late answer but I was just having this exact problem.
Did you try putting your passport.authenticate function inside an else statement?
I found that fixed this problem for me.

Express user authentication middleware, how much should it do?

I'm trying to learn Express session and authentication handling.
For example:
app.post('/login', authCredentials, function(req, res) {
console.log("second")
});
function authCredentials(req, res, next) {
//this happens first
console.log(req.body) // => { username: etc, password: etc }
next();
}
My question is just how much should my authCredentials function do?
For example if the credentials are correct, I can do something like
res.redirect('/index'). Once I do that, however, what purpose does the second function have?
Other questions:
How would I handle invalid credentials?
If I make authCredentials just return true or false depending on the credentials, doesn't that break the middleware flow because it would never invoke next()?
Is it possible to access anything in authCredentials in the anonymous callback after it? Basically in the function(req, res) { }?

The answer depends on your authentication strategy i.e. are you using session identifiers, access tokens, etc.
In either case I suggest that you break out the credential exchange (aka login) from the authentication.
function usernamePasswordExchange(req,res,next){
var username = req.body.username;
var password = req.body.password;
callToAuthService(username,password,function(err,user){
if(err){
next(err); // bad password, user doesn’t exist, etc
}else{
/*
this part depends on your application. do you use
sessions or access tokens? you need to send the user
something that they can use for authentication on
subsequent requests
*/
res.end(/* send something */);
}
});
}
function authenticate(req,res,next){
/*
read the cookie, access token, etc.
verify that it is legit and then find
the user that it’s associated with
*/
validateRequestAndGetUser(req,function(err,user){
if(err){
next(err); // session expired, tampered, revoked
}else{
req.user = user;
next();
}
});
}
app.post('/login',usernamePasswordExchange);
app.get('/protected-resource',authenticate,function(req,res,next){
/*
If we are here we know the user is authenticated and we
can know who the user is by referencing req.user
*/
});
Disclaimer: I work at Stormpath and we spend a lot of time writing
authentication code :) I just wrote our newest library, stormpath-sdk-express,
which has a concrete implementation of my suggestions

You want to add your authCredentials middleware to every end point that needs authentication. app.post('/login') usually does not need any as you want to access this end point to actually get credentials in the first place.
When credentials are correct/valid you simply invoke next() and the workflow will jump to the next middleware or the actual end point. If there was an error, invoke next() with an error object like next(new Error('could not authenticate'); for instance. Add an error route to your general routing and the error will be handled there:
app.use(function(err, req, res, next) {
res.render('error', err);
});
Should be answered by now.
A middleware does not return a value. It either calls next() or ends the process differently by calling res.send().
There are different approaches to pass variables from one middleware to another. The most common is probably to attach the desired value to the req parameter.
authenticate is an asychronous function in the following example:
function authCredentials(req, res, next) {
authenticate(req.body, function(err, user) {
if (err) {
return next(err);
}
req.user = user;
next();
});
}