Validating route params and query in Express - Step-by-Step Execution

Concept Flow - Validating route params and query

Request received

↓

Extract route params & query

↓

Validate params & query

↓

Proceed

↓

Handle request logic

↓

Send success response

When a request comes in, Express extracts route parameters and query strings, then checks if they are valid before continuing or sending an error.

Execution Sample

Express

app.get('/user/:id', (req, res) => {
  const id = req.params.id;
  const age = req.query.age;
  if (!/^[0-9]+$/.test(id) || (age && isNaN(Number(age)))) {
    return res.status(400).send('Invalid parameters');
  }
  res.send(`User ${id}, age ${age || 'unknown'}`);
});

This code checks if the route param 'id' is all digits and if the optional query 'age' is a number, sending an error if not.

Execution Table

Step	Action	Route Param 'id'	Query 'age'	Validation Result	Response
1	Request: /user/123?age=25	123	25	id valid, age valid	Proceed
2	Request: /user/abc?age=25	abc	25	id invalid	400 Invalid parameters
3	Request: /user/123?age=twenty	123	twenty	age invalid	400 Invalid parameters
4	Request: /user/456	456	undefined	id valid, age missing but optional	Proceed
5	Request: /user/789?age=30	789	30	id valid, age valid	Proceed
6	Request: /user/12a?age=30	12a	30	id invalid	400 Invalid parameters

💡 Execution stops when validation fails, sending 400 error; otherwise, request proceeds.

Variable Tracker

Variable	Start	After 1	After 2	After 3	After 4	After 5	After 6
id	undefined	123	abc	123	456	789	12a
age	undefined	25	25	twenty	undefined	30	30
validationResult	undefined	valid	invalid	invalid	valid	valid	invalid
response	undefined	proceed	400 error	400 error	proceed	proceed	400 error

Key Moments - 3 Insights

Why does the request with id='abc' fail validation?

Because the id param must be digits only, as shown in execution_table row 2 where 'abc' fails the regex test.

Is the 'age' query parameter required for the request to succeed?

No, 'age' is optional. In row 4, age is missing but validation passes because only id is required and valid.

What happens if 'age' is present but not a number?

Validation fails and a 400 error is sent, as in row 3 where age='twenty' is invalid.

Visual Quiz - 3 Questions

Look at the execution_table, what is the validation result at step 5?

A age invalid

B id invalid

C id valid, age valid

D id valid, age missing

💡 Hint

Check the 'Validation Result' column at row 5 in the execution_table.

At which step does the condition fail because 'id' contains letters?

A Step 2

B Step 1

C Step 4

D Step 5

💡 Hint

Look for 'id invalid' in the 'Validation Result' column in execution_table.

If the regex for 'id' was changed to allow letters, how would step 6 change?

A Validation would still fail due to id

B Validation would pass and response would proceed

C Validation would fail due to age

D No change, still 400 error

💡 Hint

Refer to variable_tracker for 'id' and 'validationResult' at step 6 and consider regex effect.

Concept Snapshot

Express route params and query validation:
- Extract params via req.params and query via req.query
- Use regex or type checks to validate
- If invalid, send 400 error response
- If valid, proceed with request handling
- Optional query params can be checked conditionally

Full Transcript

When Express receives a request, it extracts route parameters and query strings. The code then checks if these values meet expected formats, like digits only for an id or numeric for age. If validation fails, the server responds with a 400 error and stops processing. If validation passes, the server continues to handle the request and sends a success response. This process ensures only valid data is processed, preventing errors or misuse.