express-validator: Validate at the Edge

Why it exists

Every web server that accepts user input is a translation layer between the chaos of the open internet and the strict expectations of your application code. Without a gatekeeper, malformed strings, unexpected types, and malicious payloads reach your handlers and database directly, producing crashes, bad data, or security holes. express-validator exists to provide that gatekeeper as pluggable middleware, letting you reject or sanitize bad input before it ever touches business logic.

The mental model

Think of express-validator as a bouncer at the door of each route. Instead of letting every request into your handler and then inspecting it with nested if-statements, you declare the rules upfront. The bouncer checks ID, dress code, and guest list; if something is off, the request never enters the club. This separation keeps your route handlers focused on what to do with good data, not on how to detect bad data.

How it works

You attach validation chains to routes using methods like body, param, query, and header. Each chain is a series of methods such as isEmail, isLength, or custom validators that define what acceptable input looks like. The library registers these as standard Express middleware. When a request arrives, the chains run in order, accumulating errors without short-circuiting. After the validators, you call validationResult to collect the errors. If the result is not empty, you return a 400 response; if it is empty, you proceed to your handler. Sanitizers like trim or escape can run in the same chain, cleaning data as it passes through.

When to use it

Use express-validator on any route that ingests data you did not create. That includes POST bodies from HTML forms, JSON APIs consumed by mobile clients, query parameters for search filters, and URL parameters for resource IDs. It shines when you want readable, declarable rules that live next to the route definition rather than hidden inside utility functions. It is especially valuable when multiple developers touch the same codebase because the intent is visible right where the route is declared.

When not to use it

Do not use express-validator as your only line of defense. It validates shape and type at the edge, but it does not replace database constraints, business-rule validation that requires database lookups, or authorization checks. Also avoid it if you need extremely high-performance validation on a hot path where middleware overhead matters; in those cases, compiled schemas or hand-rolled checks may be faster. Finally, do not rely on its built-in sanitizers to stop all injection attacks; use parameterized queries and proper output encoding as well.

One canonical example

Imagine a user registration endpoint. You would write body('email').isEmail().normalizeEmail(), body('password').isLength({ min: 8 }), and body('username').trim().isAlphanumeric(). Then in the handler, you extract validationResult and return a 422 with the mapped errors if any exist. Only after that guard clause do you hash the password and insert the record. This pattern keeps the handler short, the rules explicit, and the database safe from garbage.