Block disposable email signups in Express

The code

// middleware/blockDisposable.js
async function isDisposable(email) {
  try {
    const r = await fetch(
      `https://api.checkdisposable.email/v1/check?email=${encodeURIComponent(email)}`,
      { headers: { Authorization: `Bearer ${process.env.CDE_KEY}` } }
    );
    if (!r.ok) return false;
    return (await r.json()).is_disposable === true;
  } catch {
    return false;
  }
}

module.exports = async function blockDisposable(req, res, next) {
  const email = req.body?.email;
  if (email && (await isDisposable(email))) {
    return res.status(400).json({ error: 'Please use a real email address.' });
  }
  next();
};

// routes/signup.js
const router = require('express').Router();
const blockDisposable = require('../middleware/blockDisposable');

router.post('/signup', blockDisposable, async (req, res) => {
  // ...create user
  res.json({ ok: true });
});

module.exports = router;

Notes

Use built-in fetch

Node 18+ has global fetch. Drop `node-fetch` / `axios` here — fewer deps, smaller install.

Order matters

Mount the middleware AFTER `express.json()` body parser so `req.body.email` is populated. Mount it BEFORE any DB write so failed checks never touch your user table.

Use as a function in Passport

If you use Passport-Local, call `isDisposable` inside your verify callback and pass an error to `done(null, false, { message: ... })`.