Stop 05 · Express.js & Web FrameworksTopics · 6/14

Route Parameters

In short

/users/42 and /users/43 are the same route with different values. Route parameters let one handler serve every user, order or product by its id.

Dynamic segments in a URL path (`/users/:id`) captured into `req.params` — how you identify a specific resource in a RESTful API.

The mascot walks down a corridor of doors holding a key with a coloured tag.

Think of it like this

Hostel room keys

Every room in the corridor looks the same. What changes is the number on your key tag, and that tells you which door is yours. In /rooms/:roomId, the route is the corridor and :roomId is the tag that picks the door.

Watch it happen

Matching /orders/:orderId/items/:itemId

orders

A102

items

1/5Request path /orders/A102/items/7 is split into four segments.

The big ideas

What you need to know

:name captures a segment

Whatever sits in that part of the URL lands in req.params.name.

Always strings

req.params.id is "7", not 7. Convert with Number() and check it isn't NaN.

Nest for relationships

/users/:userId/orders reads naturally: the orders belonging to that user.

app.param for reuse

app.param("orderId", loader) runs once per request to load the order for every route that uses :orderId.

See it in code

Walk through the code

1app.get("/users/:userId/orders/:orderId", async (req, res) => {2  const userId = Number(req.params.userId);3  if (!Number.isInteger(userId) || userId <= 0) {4    return res.status(400).json({ error: "userId must be a positive integer" });5  }6 7  const order = await db.orders.findOne({8    id: req.params.orderId,9    userId,10  });11  if (!order) return res.status(404).json({ error: "Order not found" });12  res.json(order);13});

1/4Two parameters in one path: the user and the order.

Checking that the order belongs to that user is not just tidy; it stops one user reading another user's orders by changing the URL.

Save yourself the pain

Common mistakes

Oops

Using req.params.id in a database query without checking the user owns that record.

Do this instead

Always filter by the logged-in user too. Otherwise anyone can guess ids and read others' data.

Oops

Comparing req.params.id === 7 and wondering why it's never true.

Do this instead

Params are strings. Compare with "7" or convert with Number() first.

Your mission

Nested resources

~20 min

Quick check

Route /products/:id, request /products/15. What is req.params.id?

Go deeper

1Build a route with multiple params, e.g. `/users/:userId/posts/:postId`.
2Validate that a param is the expected type/format before using it in a DB query.
3Learn optional params and simple pattern matching in Express routes.