mediumBackend

How do you validate and sanitize request input (zod / joi)?

Q: How do you validate and sanitize request input (zod / joi)?

**TL;DR.** Validate **every external input** (body, query, params, headers) against an explicit **schema** (zod, joi) at the **boundary**, rejecting malformed requests before they reach business logic. With **zod** the schema also **infers the TypeScript type**, giving one source of truth for runtime checks and static types. raw request schema.parse validate + coerce <path class='d-edge-da

60 views

Understand the problem

Schema validation at the API boundary.

nodejsvalidationzodsecurity

Attempt it yourself

Sketch your approach before reading the solution — that's what interviews test.

Stuck? AI Nudge Available

Get a conceptual hint to guide your logic without spoiling the final implementation.

Study the solution

The solution is waiting

Give it an honest attempt first — then compare your thinking with the full walkthrough.

Read the code

Validation middleware with zod

import { z } from 'zod';

const CreateUser = z.object({
  email: z.string().email(),
  age: z.coerce.number().int().min(13),
}).strict();                 // reject unknown keys

const validate = (schema) => (req, res, next) => {
  const r = schema.safeParse(req.body);
  if (!r.success) return res.status(400).json({ errors: r.error.issues });
  req.body = r.data;          // clean, typed
  next();
};
app.post('/users', validate(CreateUser), createUser);

Join the discussion

Discussion (0)

No responses yet. Be the first to share what you think.

Explain how clustering works in Node.js.

What is the difference between `npm ci` and `npm install`?