input-validation

Validate Everything from External Sources

// Every request body, query param, and path param is untrusted input.
// Validate at the boundary before it touches your domain logic.

Zod Schema Patterns

import { z } from 'zod';

// Base schemas (reusable)
const EmailSchema = z.string().email().max(255).toLowerCase().trim();
const PasswordSchema = z.string().min(8).max(128);
const UUIDSchema = z.string().uuid();

// Request body schema
const CreateUserSchema = z.object({
  email: EmailSchema,
  password: PasswordSchema,
  name: z.string().min(1).max(100).trim(),
  role: z.enum(['admin', 'user', 'viewer']).default('user'),
});

// Query params (all strings from URL, need coercion)
const PaginationSchema = z.object({
  page: z.coerce.number().int().min(1).default(1),
  limit: z.coerce.number().int().min(1).max(100).default(20),
  sortBy: z.enum(['createdAt', 'name', 'email']).default('createdAt'),
  sortDir: z.enum(['asc', 'desc']).default('desc'),
});

// Path params
const UserParamsSchema = z.object({
  id: UUIDSchema,
});

Middleware Approach (Express)

// Generic validation middleware
function validate<T extends z.ZodType>(schema: T, source: 'body' | 'query' | 'params') {
  return (req: Request, res: Response, next: NextFunction) => {
    const result = schema.safeParse(req[source]);
    if (!result.success) {
      return res.status(400).json({
        error: {
          code: 'VALIDATION_ERROR',
          message: 'Invalid input',
          fields: result.error.flatten().fieldErrors,
        },
      });
    }
    req[source] = result.data;  // replace with parsed/coerced data
    next();
  };
}

// Usage
router.post('/users',
  validate(CreateUserSchema, 'body'),
  asyncHandler(async (req, res) => {
    const { email, password, name, role } = req.body; // already validated
    const user = await userService.create({ email, password, name, role });
    res.status(201).json(user);
  })
);

Security Checklist