Validate Every Trust Boundary
Input Validation
Everything received from an HTTP client should be treated as untrusted input. Validate path parameters, query parameters, headers, cookies, and request bodies.
Validation should check type, format, length, allowed values, ranges, relationships between fields, and business rules where appropriate.
Validation is not only a security feature. It protects the application from malformed data and makes API behavior predictable.
Schema Validation Concept
const userSchema = {
name: { type: 'string', minLength: 1, maxLength: 100 },
email: { type: 'email' },
age: { type: 'integer', minimum: 18 }
};💡 The schema defines constraints before application logic receives the input.