Controllers are JavaScript files that contain a set of methods, called actions, reached by the client according to the requested route. Whenever a client requests the route, the action performs the business logic code and sends back the response. Controllers represent the C in the model-view-controller (MVC) pattern.
In Strapi, 2 middleware concepts coexist:
Strapi policies are functions that execute specific logic on each request before it reaches the controller. Policies can be customized according to your needs.
Strapi routes handle requests to your content and are auto-generated for your content-types. Routes can be customized according to your needs.
Strapi's Server API for plugins allows a Strapi plugin to customize the back end part (i.e. the server) of your application.