Manual validation patterns in Express - Deep Dive

Overview - Manual validation patterns

What is it?

Manual validation patterns in Express are ways to check if the data sent by users is correct before using it. Instead of relying on automatic tools, developers write code to test each piece of data. This helps catch mistakes or bad inputs early. It ensures the app works smoothly and safely.

Why it matters

Without manual validation, apps might accept wrong or harmful data, causing crashes or security problems. Manual validation lets developers control exactly how data is checked, making apps more reliable and secure. It also helps give clear feedback to users when they make mistakes.

Where it fits

Before learning manual validation, you should know basic Express routing and how to handle requests and responses. After mastering manual validation, you can explore automatic validation libraries like Joi or express-validator to speed up development.

Mental Model

Core Idea

Manual validation is like a gatekeeper that inspects every piece of user data before letting it into your app.

Think of it like...

Imagine a security guard at a building entrance checking each visitor’s ID and purpose before allowing entry. Manual validation is that guard for your app’s data.

┌───────────────┐
│ User sends    │
│ data (request)│
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ Validation    │
│ code checks   │
│ data rules    │
└──────┬────────┘
       │
  Pass │ Fail
       │
       ▼
┌───────────────┐   ┌───────────────┐
│ Continue to   │   │ Send error    │
│ app logic     │   │ response      │
└───────────────┘   └───────────────┘

Build-Up - 6 Steps

1

Foundation

Understanding request data basics

Concept: Learn where user data comes from in Express and how to access it.

In Express, user data usually comes in the request object. For example, req.body holds data sent in POST requests, req.query holds URL query parameters, and req.params holds route parameters. You can access these to read what the user sent.

Result

You can read user inputs like form fields or URL parameters inside your route handlers.

Knowing where data lives in Express requests is essential before you can check if it is valid.

2

Foundation

Writing simple validation checks

Concept: Start with basic if-statements to check data types and presence.

You can write code like: if (!req.body.name) { return res.status(400).send('Name required'); } to check if a field exists. Similarly, check if a number is really a number using typeof or Number.isNaN.

Result

Your app rejects requests missing required fields or with wrong types.

Simple checks prevent bad data from causing errors deeper in your app.

3

Intermediate

Combining multiple validation rules

🤔Before reading on: Do you think you should check all fields at once or stop at the first error? Commit to your answer.

Concept: Learn to validate several fields together and collect all errors before responding.

Instead of stopping at the first error, create an errors array. For each field, add a message if invalid. After checking all, if errors exist, send them all back to the user. This helps users fix all problems at once.

Result

Users get a list of all input mistakes in one response.

Collecting all errors improves user experience by reducing repeated form submissions.

4

Intermediate

Validating nested and complex data

🤔Before reading on: Can you guess how to check data inside objects or arrays in requests? Commit to your answer.

Concept: Learn to manually check data inside nested objects or arrays in the request body.

If req.body has an address object, check fields like req.body.address.street. For arrays, loop through each item and validate its properties. This requires careful code to avoid crashes if parts are missing.

Result

Your app safely validates complex user data structures.

Handling nested data manually teaches you the structure of your data and prevents runtime errors.

5

Advanced

Creating reusable validation functions

🤔Before reading on: Do you think writing validation inline or reusable functions is better? Commit to your answer.

Concept: Extract validation logic into functions to reuse and keep code clean.

Write functions like function validateEmail(email) { return typeof email === 'string' && email.includes('@'); } Then call these in your routes. This avoids repeating code and makes maintenance easier.

Result

Your validation code is organized, easier to read, and reusable across routes.

Reusable functions reduce bugs and speed up adding validation to new routes.

6

Expert

Balancing manual validation with libraries

🤔Before reading on: Is manual validation always better than libraries? Commit to your answer.

Concept: Understand when to use manual validation and when to use automatic tools for best results.

Manual validation gives full control but can be verbose and error-prone. Libraries like Joi or express-validator automate common checks and error formatting. Experts combine both: manual for custom rules, libraries for standard checks.

Result

You write efficient, maintainable validation that fits your app’s needs.

Knowing the tradeoffs helps you choose the right approach for each project.

Under the Hood

Express receives HTTP requests and parses data into the request object. Manual validation runs JavaScript code that inspects this data synchronously or asynchronously. It uses conditional checks to confirm data types, presence, and formats. If validation fails, the code interrupts normal flow by sending error responses, preventing further processing.

Why designed this way?

Manual validation was the original way to check data before libraries existed. It offers full flexibility and transparency. Developers can tailor checks exactly to their needs without extra dependencies. This approach fits small apps or unique validation rules better than generic tools.

┌───────────────┐
│ HTTP Request  │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ Express parses│
│ data into req │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ Manual        │
│ validation    │
│ code runs     │
└──────┬────────┘
       │
  Valid│Invalid
       │
       ▼
┌───────────────┐   ┌───────────────┐
│ Continue app  │   │ Send error    │
│ logic         │   │ response      │
└───────────────┘   └───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does manual validation automatically sanitize data? Commit yes or no.

Common Belief: Manual validation cleans and fixes bad data automatically.

Reality: Manual validation only checks data; it does not change or sanitize it unless you write code to do so.

Why it matters: Assuming validation cleans data can lead to security holes if harmful input is not properly handled.

Quick: Is manual validation always slower than using libraries? Commit yes or no.

Common Belief: Manual validation is always less efficient and slower than libraries.

Reality: Manual validation can be faster for simple checks because it avoids library overhead, but it can become slower and error-prone as complexity grows.

Why it matters: Believing manual validation is always slow may discourage learning it, missing its benefits for small or custom cases.

Quick: Does failing to validate one field mean you should stop checking others? Commit yes or no.

Common Belief: You should stop validation after the first error to save time.

Reality: It is better to check all fields and report all errors at once for better user experience.

Why it matters: Stopping early frustrates users who must fix errors one by one, increasing support requests.

Quick: Can manual validation catch all possible input errors without bugs? Commit yes or no.

Common Belief: Manual validation is foolproof if written carefully.

Reality: Manual validation is prone to human error and can miss edge cases or cause crashes if not carefully tested.

Why it matters: Overconfidence in manual validation can lead to security risks and app crashes.

Expert Zone

1

Manual validation allows fine-grained control over error messages, enabling personalized feedback beyond generic library errors.

2

Combining synchronous and asynchronous validation manually requires careful flow control to avoid blocking or missing errors.

3

Manual validation code can become complex and hard to maintain without disciplined structure and reuse.

When NOT to use

Avoid manual validation for large projects with many routes and complex schemas; use libraries like Joi or express-validator for consistency and speed. Also, avoid manual validation when you need automatic sanitization or internationalization of error messages.

Production Patterns

In production, manual validation is often used for custom rules that libraries cannot express, such as cross-field dependencies or dynamic checks. It is also common to wrap manual validation in middleware functions for reuse and separation of concerns.

Connections

Middleware pattern

Manual validation is often implemented as middleware in Express.

Understanding middleware helps you place validation logic cleanly in the request flow, improving code organization.

Defensive programming

Manual validation is a form of defensive programming to protect apps from bad inputs.

Knowing defensive programming principles clarifies why validation is critical for app stability and security.

Quality control in manufacturing

Both involve inspecting inputs carefully before allowing them to proceed.

Seeing validation as quality control helps appreciate its role in preventing defects and failures.

Common Pitfalls

#1 Stopping validation after first error

Wrong approach:

if (!req.body.name) return res.status(400).send('Name required');
if (!req.body.email) return res.status(400).send('Email required');

Correct approach:

const errors = [];
if (!req.body.name) errors.push('Name required');
if (!req.body.email) errors.push('Email required');
if (errors.length) return res.status(400).send(errors.join(', '));

Root cause:

Misunderstanding that reporting all errors at once improves user experience.

#2 Not checking nested data safely

Wrong approach:

if (!req.body.address.street) return res.status(400).send('Street required');

Correct approach:

if (!req.body.address || !req.body.address.street) return res.status(400).send('Street required');

Root cause:

Assuming nested objects always exist, causing runtime errors.

#3 Mixing validation and business logic

Wrong approach:

if (req.body.age < 18) return res.status(400).send('Too young');
// Also checking user permissions here

Correct approach:

// Validation middleware only checks data format
// Business logic handled separately after validation

Root cause:

Confusing validation responsibilities with other app concerns.

Key Takeaways

Manual validation in Express means writing your own code to check user data before using it.

It gives you full control but requires careful coding to avoid errors and improve user experience.

Collecting all errors before responding helps users fix inputs faster and reduces frustration.

Manual validation works best for custom or simple checks, while libraries help with complex schemas.

Understanding manual validation deepens your grasp of app security, stability, and data flow.