Why express say `Cannot set headers after they are sent to the client` in my code?

Question

I'm creating some kind of SignIn request/response in Express. When user give valid username & password, then server will return valid authorization code.

This is code.

export const getAuthKey = async (req, res, next) => {
    // Query parameter : :username, :hash(SHA256 encoded pasword)
    // Return : { authKey: authKey }
    if (req.query.username === undefined) { res.status(400).send('`username` query paramter missing.'); }
    if (req.query.hash === undefined) { res.status(400).send('`hash` query paramter missing.'); }
    getConnection()
        .then(conn => new Promise((resolve, reject) => {
            const escapeUserName = conn.escape(req.query.username);
            const escapeSHA256 = conn.escape(req.query.hash);
            return conn.query(`SELECT HEX(AuthorizationKey) AS authKey FROM UserInfo WHERE UserName = ${escapeUserName} AND UserPassword = UNHEX(${escapeSHA256});`)
                .then(result => resolve(result))
                .catch(err => reject(err))
                .finally(() => { conn.end(); });
        }))
        .then(auth => {
            if (auth.length < 1) { res.status(401).send('No such user found'); }
            else { 
                log(`User ${req.query.username} requests valid authorization.`, `AUTH`)
                res.json(auth[0]); 
            }
        })
        .catch(err => {
            log('Unable to get authKey', 'AUTH', 'ERROR', err);
            res.status(500).send(`Unable to logging-in`);
        });
}

The steps are simple,

1. User send request with parameter username and hash(password) 1-1. If parameter is not fulfilled, it returns status 400. 2. Check Database and find if user is valid, if so, return it's authorization code. 3-2 If there are some unexpected error, returns status 500.

This code works. But I always see (node:11580) UnhandledPromiseRejectionWarning: Error [ERR_HTTP_HEADERS_SENT]: Cannot set headers after they are sent to the client

I think I miss something about http request. Can you tell me what is wrong? Also would you provide me a code pattern for this kind of process?

p.s please ignore async on function definition.

Answer 1

The particular error you asked about "Cannot set headers after they are sent to the client" is caused by attempting to send a second response to the same request. So, there is typically a problem with the flow through your code that causes it to execute multiple code paths that can send a response.

On these two statements, you need to add a return statement so code does not continue executing in your function after you've sent a response:

if (req.query.username === undefined) { res.status(400).send('`username` query paramter missing.'); }
if (req.query.hash === undefined) { res.status(400).send('`hash` query paramter missing.'); }

Even though you've called res.send(), normal Javascript flow control still applies and the rest of your function will continue to execute, causing you to attempt to send another response which is the source of the "headers already sent" warning.

So, add a return to each one of these if statements to stop the function from further execution after sending the response.

if (req.query.username === undefined) { 
    res.status(400).send('`username` query parameter missing.'); 
    return;
}
if (req.query.hash === undefined) { 
    res.status(400).send('`hash` query parameter missing.'); 
    return;
}

I'd also suggest you modify these if statements slightly to include more conditions like empty strings:

if (!req.query.username) { 
    res.status(400).send('`username` query parameter missing.'); 
    return;
}
if (!req.query.hash) { 
    res.status(400).send('`hash` query parameter missing.'); 
    return;
}

FYI, also fix the spelling of "parameter".