The Response Object

res.send('Hello');               // text/html
res.send('<h1>Hello</h1>');      // text/html
res.send({ key: 'value' });      // application/json (deprecated — prefer res.json)
res.send(Buffer.from('binary')); // application/octet-stream
res.send();                      // 204 No Content (no body)

res.json({ user: 'Alice', age: 30 });
res.json([1, 2, 3]);
res.json(null);               // valid JSON null
res.status(201).json(created);

// GET /data?callback=myFunc
res.jsonp({ value: 42 }); // → myFunc({"value":42})

res.sendStatus(200); // 'OK'
res.sendStatus(201); // 'Created'
res.sendStatus(204); // 'No Content'
res.sendStatus(404); // 'Not Found'
res.sendStatus(500); // 'Internal Server Error'

res.end();               // no body
res.end('done');         // raw string, no Content-Type set

res.status(404).json({ error: 'Not found' });
res.status(201).send('Created');
res.status(400).end();

res.redirect('/new-path');            // 302 (temporary, default)
res.redirect(301, '/permanent');      // 301 permanent
res.redirect(307, '/temp');           // 307 preserves method
res.redirect(308, '/permanent');      // 308 preserves method + permanent
res.redirect('back');                 // redirect to Referer header (or '/')
res.redirect('..');                   // one level up
res.redirect('https://example.com'); // absolute URL

// res.sendFile — serve a file, Content-Type from extension
res.sendFile('/absolute/path/to/file.pdf');
res.sendFile(path.join(__dirname, 'public', 'index.html'));

// With options
res.sendFile('/path/to/file', {
  maxAge: '1d',        // cache max-age
  root: __dirname,     // allows relative path
  dotfiles: 'deny',    // 'allow', 'deny', 'ignore'
  headers: { 'X-Custom': 'value' },
}, (err) => {
  if (err) next(err);
});

// res.download — sets Content-Disposition: attachment (triggers browser download)
res.download('/path/to/report.pdf');
res.download('/path/to/report.pdf', 'my-report.pdf');       // custom filename
res.download('/path/to/report.pdf', 'my-report.pdf', (err) => {
  if (err) next(err);
});

app.set('view engine', 'ejs');
app.set('views', path.join(__dirname, 'views'));

res.render('index');                                   // views/index.ejs
res.render('user/profile', { user: req.user });        // pass locals
res.render('page', locals, (err, html) => {            // callback — don't send yet
  if (err) return next(err);
  res.send(html);
});

res.set('X-Custom-Header', 'value');
res.set({ 'X-Foo': 'bar', 'X-Baz': 'qux' });  // object form
res.header('X-Custom', 'value');                // alias for res.set()

res.get('Content-Type');   // read a set header (before sending)

res.removeHeader('X-Powered-By');

res.type('html');               // text/html; charset=utf-8
res.type('json');               // application/json
res.type('png');                // image/png
res.type('text/plain');         // explicit MIME type
res.type('application/octet-stream');

res.cookie('name', 'value');
res.cookie('session', token, {
  httpOnly: true,             // inaccessible to JS
  secure: true,               // HTTPS only
  sameSite: 'strict',         // 'strict' | 'lax' | 'none'
  maxAge: 7 * 24 * 60 * 60 * 1000,  // ms until expiry
  expires: new Date('2025-01-01'),   // absolute expiry date
  path: '/',
  domain: '.example.com',
  signed: true,               // requires cookie-parser secret
});

res.clearCookie('session', { path: '/', httpOnly: true });

// Manual streaming
res.set('Content-Type', 'text/plain');
res.write('chunk 1\n');
res.write('chunk 2\n');
res.end();

// Pipe a readable stream
const fs = require('fs');
fs.createReadStream('large-file.csv').pipe(res);

// Server-Sent Events
res.set({
  'Content-Type': 'text/event-stream',
  'Cache-Control': 'no-cache',
  'Connection': 'keep-alive',
});
res.flushHeaders();

const id = setInterval(() => {
  res.write(`data: ${JSON.stringify({ time: Date.now() })}\n\n`);
}, 1000);

req.on('close', () => clearInterval(id));

// Set in middleware
app.use((req, res, next) => {
  res.locals.user = req.user;
  res.locals.csrfToken = req.csrfToken?.();
  next();
});

// Available in all res.render() calls automatically
res.render('dashboard'); // template sees user, csrfToken

// Set Link header (used for pagination)
res.links({
  next: '/items?page=2',
  prev: '/items?page=0',
  last: '/items?page=10',
});
// → Link: </items?page=2>; rel="next", </items?page=0>; rel="prev", ...

// Set Location header (without redirecting)
res.location('/new-resource');
res.location('https://example.com');

res.vary('Accept');          // Vary: Accept
res.vary('Accept-Encoding');