Node.js · Chapter 24 of 43
Input Validation
Validation ensures incoming data meets expected rules (required fields, correct types, valid formats) before your app processes it. Never trust client input.
Libraries like `joi`, `zod`, or `express-validator` make validation declarative and reduce repetitive manual checks.
Manual validation
You can manually check fields and return a 400 Bad Request response when data is invalid.
Using a validation library
Libraries define a schema describing expected shape and constraints, then validate incoming data against it in one call.
Example 1 (javascript)
app.post('/users', express.json(), (req, res) => {
const { name, age } = req.body;
if (!name || typeof age !== 'number') {
return res.status(400).json({ error: 'Invalid input' });
}
res.status(201).json({ name, age });
});Output
{"error":"Invalid input"} (if age is missing/wrong type)Manual checks reject bad input early with a 400 status.
Example 2 (javascript)
const { z } = require('zod');
const schema = z.object({ name: z.string(), age: z.number() });
const result = schema.safeParse({ name: 'Ada', age: 'old' });
console.log(result.success);Output
falseZod validates the shape and types of data declaratively, returning success/failure.
Key points
- Never trust incoming client data without validation.
- Invalid input should return a 400 Bad Request.
- Validation libraries like Zod/Joi reduce manual boilerplate.
- Validate as early as possible in the request lifecycle.
💡 Note: Validation also helps prevent security issues like injection attacks.