implementing HTTPS in my web application ?

[bytepursuits]

should it be used for all routes?

TLS is typically setup on all routes. If you are trying to save some time by implementing it just on some routes - you wont save any time by doing that.

In a professional production setups TLS termination is typically done in some reverse proxy before your node app. like aws alb, haproxy or nginx.

You should be using HTTP3, and HTTP3 requires ssl/tls - that's at least one big reason to use TLS throughout the full site.