Never Trust Client Input: API Validation

Why it exists

Applications are vulnerable when they blindly trust data from clients. Malicious or malformed input can cause crashes, data corruption, or security breaches like SQL injection. API request validation exists to create a defensive perimeter, ensuring that only data conforming to expected rules gets processed by your application logic.

The mental model

Think of API request validation as a strict contract for your API. The server defines the exact format, type, and constraints for all incoming data. Any request that violates this contract is rejected at the door, like a bouncer checking an ID. This frees your core business logic from having to worry about malformed or malicious inputs, simplifying code and hardening security.

How it works

In Express.js, validation is typically implemented as middleware that runs before your main route handler. Libraries like express-validator provide a "validation chain" where you declare rules for specific fields. The middleware intercepts the request, checks fields in req.body, req.query, req.params, req.headers, and req.cookies against these rules. If validation fails, it attaches an error object to the request, allowing your code to send a 400 Bad Request response before any business logic is touched.

When to use it

Use it on every single API endpoint that accepts input from an external source. This is non-negotiable for production systems. It's especially critical for routes that create or update data, such as user registration, profile updates, or any form submission. It protects your database integrity and prevents a wide class of bugs and security vulnerabilities.

When not to use it

There's almost no case where you shouldn't validate external input. However, you might skip it for internal-only, system-to-system APIs where the calling service is fully trusted and under your control, though even this is risky. Over-validation can also be a problem; applying overly strict rules (e.g., a very restrictive regex for names) can lead to poor user experience by rejecting valid inputs.

One canonical example

The express-validator library is a standard choice in the Node.js ecosystem. It wraps the powerful validator.js library. You can define a chain of checks for an endpoint, like ensuring a 'password' field in the request body is at least 8 characters long and a 'username' field is alphanumeric. If the incoming request fails these checks, the middleware stops the request from proceeding and lets you return a structured error message to the client.