Request Validation
Client se aane waala data KABHI TRUST mat karo — types, ranges, required fields, sab validate karna zaroori hai. Validation ko middleware bana lene se route handler saaf rehta hai aur wahi schema reuse ho jaata hai.
Joi aur Zod schema-based hain (ek schema likho, poora object validate karo) jabki express-validator chain-based hai. Zod ka bonus ye hai ki TypeScript mein wo types bhi infer kar leta hai.
const { z } = require("zod");
const userSchema = z.object({
name: z.string().min(2),
email: z.string().email(),
age: z.number().int().min(13).optional(),
});
const validate = (schema) => (req, res, next) => {
const r = schema.safeParse(req.body);
if (!r.success) return res.status(400).json({ errors: r.error.issues });
req.body = r.data; // sanitized data aage jaata hai
next();
};
app.post("/users", validate(userSchema), createUser);- Client data kabhi trust mat karo — DB se pehle validate karo
- Validation middleware banao taaki schema reuse ho aur handler saaf rahe
- Parsed/sanitized value se req.body replace karo, extra fields hat jaate hain
Sirf body nahi — params (id numeric hai?), query (limit 1000 to nahi maang raha?) aur headers bhi validate karo. Validation "fail fast" honi chahiye: DB call se PEHLE, taaki galat request par database load hi na pade.
const schemas = { body: bodySchema, query: querySchema, params: paramsSchema };
const validate = (s) => (req, res, next) => {
for (const key of ["body", "query", "params"]) {
if (!s[key]) continue;
const r = s[key].safeParse(req[key]);
if (!r.success) return res.status(400).json({ errors: r.error.issues });
req[key] = r.data;
}
next();
};Validation batati hai ki data SAHI SHAPE mein hai ya nahi (email valid hai?), sanitization data ko SAAF karti hai (trim, lowercase, HTML tags hataana). Dono chahiye — validation galat data rokti hai, sanitization theek data ko surakshit banati hai.