Field guide · HTTP server
Node.js HTTP server: what matters in production?
Short answer
Start with explicit boundaries, not throughput: routing needs a predictable order, body reading needs a limit, every async handler needs a timeout and error path, and stopping needs a drain contract. swm-core 5.1.2 collects these boundaries in an HTTP/WebSocket server layer over a native transport.
- 5.1.2
- swm-core
- HTTP + WS
- one server instance
- 22 / 24
- Node.js
Scope
This is not a framework ranking. It describes the verifiable @swarmmachina/swm-core 5.1.2 contract for Node.js 22/24; TLS, the reverse proxy, and deployment remain external system boundaries.
Minimum Node.js HTTP server contract
| Area | Explicit contract | Pre-launch check |
|---|---|---|
| Routes | Match order, method, and fallback do not depend on incidental handler registration. | Cover static, parameterized, method-mismatch, and not-found paths. |
| Request body | Limits exist for the whole server and, when needed, for an individual route. | Test an oversized body, absent content-length, and stopping reads after rejection. |
| Headers | Prefetch reads only required headers, while transport.trustedProxy separately declares the header and exact hop count. | Check unwanted reads, forged forwarded headers, and fallback to the upstream peer. |
| Async work | A timeout and error path never leave a request context or response in an undefined state. | Integration-test a timeout, rejected promise, and a double response. |
| Observability | Errors are delivered asynchronously without turning delivery into an unbounded queue. | Check counters, redaction, and a slow error handler. |
| Termination | New requests stop, active work gets bounded drain time, then the socket closes. | Run a long-request test and record its result before the shutdown timeout. |
Choose the abstraction level
- 01
You need an API service with HTTP and WebSocket
Start with swm-coreRouting, contexts, body budgets, timeouts, backpressure, and shutdown are already in the server contract.
- 02
You need only a compatible low-level API
Evaluate swm-uwsThe application layer then owns routing, admission control, and lifecycle itself.
- 03
You are comparing performance
Fix the scenario firstThroughput without payload, concurrency, tail latency, and resource limits does not answer a production suitability question.
What one number cannot promise
- A fast empty GET response does not prove safe body handling, error behavior, or slow-client handling.
- TLS, reverse-proxy limits, and admission control must agree outside the Node.js process.
- Do not enable trustedProxy on a public listener: the nearest proxy must overwrite or sanitize the selected header.
- Selective prefetch reduces per-request work but does not replace measuring your own traffic.
Primary sources
The claimed capabilities are tied to the fixed README and package metadata of the published release.