Blocking requests within Express Is this the correct way to block requests in Express?

app.js

app.use("/", indexRouter);

app.use(function(req, res, next) {
  next(createError(404));
});

app.use(function(err, req, res, next) {
  res.locals.message = err.message;
  res.locals.error = req.app.get("env") === "development" ? err : {};
  console.log(err);
  res.status(err.status || 500);
  res.json({ error: err.message });
});


controller

exports.fetch_seat = (req, res, next) =&gt; {
  const errors = validationResult(req);
  if (!errors.isEmpty()) {
    return res.status(422).json({ error: true, message: errors.array() });
  }

  Seat.getSeatByNumber(req.params.seatNumber, (err, seat) =&gt; {
    if (err) res.json(err);
    else res.json(seat);
  });
};


model

Seat.findSeat = function(key, value) {
  return new Promise((resolve, reject) =&gt; {
    const seat = file.find(r =&gt; r[key] === value);
    if (!seat) {
      reject({
        error: true,
        message: "Seat not found",
        status: 404
      });
    }
    resolve(seat);
  });
};

Seat.getSeatByNumber = function(seatNumber, result, next) {
  try {
    this.findSeat("seatNumber", seatNumber)
      .then(seat =&gt; {
        console.log(seat);
        if (seat !== undefined &amp;&amp; Object.keys(seat).length &gt; 0) {
          return result(null, seat);
        } else {
          return result({
            error: true,
            message: "Seat not found",
            status: 404
          });
        }
      })
      .catch(error =&gt; {
        console.log(error);
        console.log("1st catch");
        return result(error, null);
      });
  } catch (error) {
    console.log("outer catch");
    console.log(error);
    return result(error);
  }
};


I have changed the functions within my model to promises. do i need it to be promises from the controller?
If possible, always whitelist acceptable sources instead of trying to blacklist harmful ones. Also, don't use try-catch for control flow, use it for what it's designed for: error handling. 

All that being said, you aren't passing the promise out of the model, because you wait for the response with .then, so no you wouldn't have to make the controller methods promises as well, but why wouldn't you? JS is single-threaded, so always default to asynchronous operations to be non-blocking.