Serving Static Files (and when not to)

Static Files in Production

Express can serve static assets, but production deployments often place static content behind a CDN or reverse proxy. If you serve static files from Express, you must treat it as part of your performance and security posture.

Cache and Immutability

Use fingerprinted filenames (hash-based) for assets and set long cache lifetimes. Avoid caching HTML entrypoints aggressively unless you have a cache invalidation strategy.

Safe Directory Boundaries

Only expose a dedicated public directory. Never serve your project root. Accidental exposure of configuration files is a common production incident.

import express from 'express';
import path from 'path';

const app = express();
app.use('/static', express.static(path.join(process.cwd(), 'public')));