middlewares_exercise_3rd_party.md

Third-party middleware exercises for the MVC starter

Context: you already have the MVC starter shown in the prompt. For these tasks you will add and use third‑party middleware. Keep changes minimal and focused on third‑party usage.

Prerequisites

Install the libraries first.

npm i morgan express-rate-limit

Ground rules

1. Do not modify controllers or schemas.

2. Keep your changes small. Only touch the file the exercise asks for.

3. Use Postman for checks. Steps are included.

---

Exercise 1: Add morgan logging only for API routes

Goal: use a third‑party middleware to log requests concisely for anything under /api, while leaving the base route clean.

What to build

• Register morgan with the dev format.

• Scope it so it runs only for routes under /api.

• Do not remove your existing custom logger. This will let you compare outputs.

Where to put it

• Edit server.js.

• Place the morgan registration after app.use(cors()) and before app.use("/api/students", student).

Implementation snippet (copy into server.js)

// 3rd‑party middleware: morgan request logger for API routes
const morgan = require("morgan");

// Log only for /api paths to avoid double noise on the base route
app.use("/api", morgan("dev"));

Quick checks (Postman)

Base route not logged by morgan

1. GET http://localhost:5000/ in Postman.

2. Expect normal 200 response. In the server console you should see your custom app‑level log, but not a morgan line for this request.

API route logged by morgan

1. GET http://localhost:5000/api/students.

2. Expect a morgan line like GET /api/students 200 - X ms in the console, in addition to any custom logging you already have.

---

Exercise 2: Add express-rate-limit with different limits for read and write

Goal: apply a third‑party middleware to protect your endpoints. Use one limiter for reads and a stricter one for writes.

What to build

1. Create a read limiter for GET requests under /api/students that allows 10 requests per minute per IP.

2. Create a write limiter for the POST /api/students route that allows 3 requests per minute per IP.

3. When a client exceeds the limit, respond with JSON { msg: "Too many requests, please try again later" } and status 429.

Where to put it

• Edit routes/student_route.js so the limiters attach at the route level. This keeps the exercise focused on third‑party usage without touching controllers.

Starter scaffold (paste in routes/student_route.js and fill the TODOs)

const rateLimit = require("express-rate-limit");

// 3rd‑party middleware: read limiter for GETs
const readLimiter = rateLimit({
  // TODO 1: set a 1 minute window (in ms)
  // TODO 2: set the request limit to 10
  // TODO 3: provide a custom handler that sends res.status(429).json({ msg: "Too many requests, please try again later" })
});

// 3rd‑party middleware: write limiter for POST
const writeLimiter = rateLimit({
  // TODO 1: set a 1 minute window (in ms)
  // TODO 2: set the request limit to 3
  // TODO 3: provide the same custom JSON handler as above
});

// Attach the read limiter to both GET endpoints
// api.get("/", readLimiter, getAllStudents);
// api.get(":id", readLimiter, getOneStudent);

// Attach the write limiter to POST
// api.post("/", writeLimiter, createStudent);

Hints

• Check out the official documentation for this package

• windowMs expects milliseconds.

• You can copy the same handler function for both limiters.

• Keep the existing api.use(...) logger in this file. You are attaching limiters directly on specific routes.

Quick checks (Postman)

Read limiter

1. Send 10 quick GET requests to http://localhost:5000/api/students.

2. The first 10 should succeed. A 11th request within one minute should return 429 with the JSON message.

Write limiter

1. Send 3 quick POST requests to http://localhost:5000/api/students with a valid JSON body and Content-Type: application/json.

2. A 4th POST within one minute should return 429 and the JSON message. Your controller should not run.

---

Done criteria

• Exercise 1 adds morgan and logs only under /api.

• Exercise 2 adds express-rate-limit and applies different limits to GET and POST routes.

• Controllers and schemas remain unchanged. Only server.js and routes/student_route.js were touched where the exercise specified.