Request Validation
Never trust user input. Validate everything.
When to Use This Skill
- All API endpoints accepting user input
- Form submissions
- File uploads
- Query parameters
- Webhook payloads
TypeScript Implementation (Zod)
Schema Definition
// schemas/user.ts
import { z } from 'zod';
export const createUserSchema = z.object({
email: z.string().email('Invalid email address'),
password: z
.string()
.min(8, 'Password must be at least 8 characters')
.regex(/[A-Z]/, 'Password must contain uppercase letter')
.regex(/[0-9]/, 'Password must contain a number'),
name: z.string().min(1).max(100).trim(),
role: z.enum(['user', 'admin']).default('user'),
metadata: z.record(z.string()).optional(),
});
export const updateUserSchema = createUserSchema.partial().omit({ password: true });
export const userIdSchema = z.object({
id: z.string().uuid('Invalid user ID'),
});
export const listUsersSchema = z.object({
page: z.coerce.number().int().positive().default(1),
limit: z.coerce.number().int().min(1).max(100).default(20),
search: z.string().max(100).optional(),
role: z.enum(['user', 'admin']).optional(),
sortBy: z.enum(['name', 'createdAt', 'email']).default('createdAt'),
sortOrder: z.enum(['asc', 'desc']).default('desc'),
});
// Infer types from schemas
export type CreateUserInput = z.infer<typeof createUserSchema>;
export type UpdateUserInput = z.infer<typeof updateUserSchema>;
export type ListUsersQuery = z.infer<typeof listUsersSchema>;Validation Middleware
// middleware/validate.ts
import { Request, Response, NextFunction } from 'express';
import { ZodSchema, ZodError } from 'zod';
interface ValidationSchemas {
body?: ZodSchema;
query?: ZodSchema;
params?: ZodSchema;
}
function validate(schemas: ValidationSchemas) {
return async (req: Request, res: Response, next: NextFunction) => {
const errors: Array<{ field: string; message: string }> = [];
try {
if (schemas.body) {
req.body = schemas.body.parse(req.body);
}
if (schemas.query) {
req.query = schemas.query.parse(req.query);
}
if (schemas.params) {
req.params = schemas.params.parse(req.params);
}
next();
} catch (error) {
if (error instanceof ZodError) {
const formattedErrors = error.errors.map(err => ({
field: err.path.join('.'),
message: err.message,
}));
return res.status(400).json({
error: 'Validation failed',
details: formattedErrors,
});
}
next(error);
}
};
}
export { validate };Route Usage
// routes/users.ts
import { validate } from '../middleware/validate';
import { createUserSchema, userIdSchema, listUsersSchema } from '../schemas/user';
router.post(
'/users',
validate({ body: createUserSchema }),
async (req, res) => {
// req.body is typed and validated
const user = await userService.create(req.body);
res.status(201).json(user);
}
);
router.get(
'/users/:id',
validate({ params: userIdSchema }),
async (req, res) => {
const user = await userService.findById(req.params.id);
res.json(user);
}
);
router.get(
'/users',
validate({ query: listUsersSchema }),
async (req, res) => {
// req.query is typed with defaults applied
const users = await userService.list(req.query);
res.json(users);
}
);Custom Validators
// schemas/custom.ts
import { z } from 'zod';
// Phone number with formatting
export const phoneSchema = z
.string()
.transform(val => val.replace(/\D/g, ''))
.refine(val => val.length >= 10 && val.length <= 15, 'Invalid phone number');
// Slug (URL-safe string)
export const slugSchema = z
.string()
.min(1)
.max(100)
.regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'Invalid slug format');
// Date string to Date object
export const dateSchema = z
.string()
.datetime()
.transform(val => new Date(val));
// Sanitized HTML (strip dangerous tags)
export const safeHtmlSchema = z
.string()
.transform(val => sanitizeHtml(val, { allowedTags: ['b', 'i', 'em', 'strong', 'a', 'p'] }));
// File upload validation
export const fileSchema = z.object({
mimetype: z.enum(['image/jpeg', 'image/png', 'application/pdf']),
size: z.number().max(10 * 1024 * 1024, 'File too large (max 10MB)'),
originalname: z.string(),
});Python Implementation (Pydantic)
# schemas/user.py
from pydantic import BaseModel, EmailStr, Field, field_validator
from typing import Optional
from enum import Enum
class UserRole(str, Enum):
user = "user"
admin = "admin"
class CreateUserInput(BaseModel):
email: EmailStr
password: str = Field(min_length=8)
name: str = Field(min_length=1, max_length=100)
role: UserRole = UserRole.user
metadata: Optional[dict[str, str]] = None
@field_validator('password')
@classmethod
def password_strength(cls, v: str) -> str:
if not any(c.isupper() for c in v):
raise ValueError('Password must contain uppercase letter')
if not any(c.isdigit() for c in v):
raise ValueError('Password must contain a number')
return v
@field_validator('name')
@classmethod
def strip_name(cls, v: str) -> str:
return v.strip()
class UpdateUserInput(BaseModel):
email: Optional[EmailStr] = None
name: Optional[str] = Field(None, min_length=1, max_length=100)
role: Optional[UserRole] = None
class ListUsersQuery(BaseModel):
page: int = Field(default=1, ge=1)
limit: int = Field(default=20, ge=1, le=100)
search: Optional[str] = Field(None, max_length=100)
role: Optional[UserRole] = NoneFastAPI Usage
# routes/users.py
from fastapi import APIRouter, Query, Path, HTTPException
from schemas.user import CreateUserInput, UpdateUserInput, ListUsersQuery
router = APIRouter()
@router.post("/users", status_code=201)
async def create_user(data: CreateUserInput):
# data is validated and typed
user = await user_service.create(data.model_dump())
return user
@router.get("/users/{user_id}")
async def get_user(user_id: str = Path(pattern=r'^[0-9a-f-]{36}$')):
user = await user_service.find_by_id(user_id)
if not user:
raise HTTPException(404, "User not found")
return user
@router.get("/users")
async def list_users(
page: int = Query(default=1, ge=1),
limit: int = Query(default=20, ge=1, le=100),
search: str = Query(default=None, max_length=100),
):
return await user_service.list(page=page, limit=limit, search=search)Error Response Format
{
"error": "Validation failed",
"details": [
{ "field": "email", "message": "Invalid email address" },
{ "field": "password", "message": "Password must be at least 8 characters" }
]
}Best Practices
- Validate at the edge - Before any business logic
- Use schema inference - Don't duplicate types
- Provide helpful messages - Tell users how to fix errors
- Sanitize strings - Trim whitespace, escape HTML
- Set sensible defaults - Reduce required fields
Common Mistakes
- Validating after database operations
- Generic error messages ("Invalid input")
- Not validating query parameters
- Missing max length on strings (DoS vector)
- Not sanitizing HTML content