How do you validate request input?
Answer
Validate params, query strings, headers, and body against an explicit schema at the HTTP boundary. Reject invalid input with a clear 400-level response, use the validated value downstream, and enforce authorization separately from validation.
Context
Express is a minimal Node.js HTTP framework. Compose routes from small middleware functions, validate untrusted input at the boundary, and send errors to one consistent error handler.
Example
Consider a production Express change: define the expected behavior and failure modes first, implement the smallest observable change, then verify it with a focused test or measurement. The right implementation depends on the system boundary and its constraints.
Practical considerations
- Choose the approach from the requirement and constraints, not from habit.
- Include validation, error handling, and cleanup where the boundary requires them.
- Verify the observable result with focused tests or measurement.
Follow-up prompts
- What failure mode would you expect if this were implemented incorrectly?
- How would you test this behaviour?
- What changes when the feature must scale to a larger application or team?
In practice
For this hard-level topic, make assumptions explicit, choose the smallest safe implementation, and verify the behavior at the relevant boundary.