Request validation in Node.js - Mini Project: Build & Apply

Request Validation in Node.js

📖 Scenario: You are building a simple Node.js server that accepts user data through a POST request. To keep your server safe and reliable, you need to check that the data sent by users is correct before using it.

🎯 Goal: Build a Node.js server that validates incoming request data to ensure it has the correct fields and types before processing.

📋 What You'll Learn

Create an object representing user data with specific fields

Add a configuration variable to define required fields

Write a function to validate the user data against the required fields

Integrate the validation function into a simple HTTP server request handler

💡 Why This Matters

🌍 Real World

Validating user input is essential to prevent errors and security issues in web servers and APIs.

💼 Career

Backend developers often write validation logic to ensure data integrity before processing or storing user data.

1

Create user data object

Create a constant called userData with these exact properties: name set to "Alice", email set to "[e-mail]", and age set to 30.

Node.js

# Create the userData object with name, email, and age
# Your code here

Hint

Use const to create an object with the exact keys and values.

2

Define required fields array

Create a constant called requiredFields that is an array containing the strings "name", "email", and "age".

Node.js

const userData = { name: "Alice", email: "[e-mail]", age: 30 };

# Create the requiredFields array with "name", "email", and "age"
# Your code here

Hint

Use an array literal with the exact strings inside.

3

Write validation function

Write a function called validateUserData that takes one parameter data. Inside, use a for loop with variable field to iterate over requiredFields. For each field, check if data[field] is undefined. If so, return false. After the loop, return true.

Node.js

const userData = { name: "Alice", email: "[e-mail]", age: 30 };
const requiredFields = ["name", "email", "age"];

# Write the validateUserData function below
# Your code here

Hint

Use a for...of loop and check each required field in the data object.

4

Use validation in HTTP server

Create a simple HTTP server using Node.js http module. Inside the request handler, call validateUserData(userData). If it returns true, set response status code to 200 and end with "Valid data". Otherwise, set status code to 400 and end with "Invalid data". Export the server as server.

Node.js

const userData = { name: "Alice", email: "[e-mail]", age: 30 };
const requiredFields = ["name", "email", "age"];

function validateUserData(data) {
    for (const field of requiredFields) {
        if (data[field] === undefined) {
            return false;
        }
    }
    return true;
}

# Create an HTTP server that uses validateUserData and responds accordingly
# Your code here

Hint

Use http.createServer and call validateUserData inside the request handler.

Practice

1. What is the main purpose of request validation in a Node.js app?

easy

A. To store data in the database

B. To speed up the server response time

C. To check incoming data before using it

D. To create new routes automatically

Solution

1. Step 1: Understand request validation

   Request validation means checking the data sent by users before the app uses it.

2. Step 2: Identify the main goal

   The goal is to ensure data is safe and correct to avoid errors or security issues.

3. Final Answer:

   To check incoming data before using it -> Option C

4. Quick Check:

   Request validation = check data first [OK]

Hint: Validation means checking data before use [OK]

Common Mistakes:

• Thinking validation speeds up server
• Confusing validation with data storage
• Assuming validation creates routes

2. Which code snippet correctly uses express-validator to check if 'email' is valid?

easy

A. validateEmail('email').isValid()

B. validate('email').isEmail()

C. checkEmail('email').validate()

D. check('email').isEmail()

Solution

1. Step 1: Recall express-validator syntax

   express-validator uses check('fieldName').validationMethod() to validate fields.

2. Step 2: Match correct method for email

   The method is isEmail() to check if the input is a valid email.

3. Final Answer:

   check('email').isEmail() -> Option D

4. Quick Check:

   express-validator uses check() + isEmail() [OK]

Hint: Use check('field').isEmail() for email validation [OK]

Common Mistakes:

• Using validate() instead of check()
• Wrong method names like validateEmail()
• Mixing method order or names

3. Given this code, what will be the output if the request body has { email: 'not-an-email' }?

app.post('/signup', [
  check('email').isEmail(),
  (req, res) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }
    res.send('Success');
  }
]);

medium

A. Response with status 400 and error details

B. Response with 'Success' message

C. Server crashes with an error

D. Response with status 200 and empty body

Solution

1. Step 1: Check validation rule

   The rule check('email').isEmail() requires a valid email format.

2. Step 2: Analyze input and error handling

   The input 'not-an-email' fails isEmail(), so errors.isEmpty() is false, triggering status 400 with error details.

3. Final Answer:

   Response with status 400 and error details -> Option A

4. Quick Check:

   Invalid email triggers 400 error [OK]

Hint: Invalid input triggers 400 error with details [OK]

Common Mistakes:

• Assuming success response on invalid input
• Expecting server crash on validation fail
• Ignoring error handling logic

4. Identify the error in this validation middleware:

app.post('/login', [
  check('password').isLength({ min: 6 }),
  (req, res) => {
    const errors = validationResult;
    if (!errors.isEmpty()) {
      return res.status(422).json({ errors: errors.array() });
    }
    res.send('Logged in');
  }
]);

medium

A. validationResult is not called with req, so errors is not an object with isEmpty()

B. isLength should be isMinLength for password check

C. Missing next() call to continue middleware chain

D. Response status 422 is invalid for validation errors

Solution

1. Step 1: Check usage of validationResult

   validationResult must be called as validationResult(req) to get errors from the request.

2. Step 2: Identify the mistake in code

   The code assigns errors = validationResult without calling it, so errors is not an object with isEmpty().

3. Final Answer:

   validationResult is not called with req, so errors is not an object with isEmpty() -> Option A

4. Quick Check:

   Call validationResult(req) to get errors [OK]

Hint: Always call validationResult(req) to get errors [OK]

Common Mistakes:

• Forgetting to call validationResult as a function
• Using wrong validation method names
• Confusing middleware flow with next()

5. You want to validate a request body with fields 'username' (required, min 3 chars) and 'age' (optional, must be a number if present). Which express-validator setup is correct?

hard

A. [check('username').optional().isLength({ min: 3 }), check('age').isNumeric()]

B. [check('username').isLength({ min: 3 }).notEmpty(), check('age').optional().isNumeric()]

C. [check('username').isLength({ min: 3 }), check('age').notEmpty().isNumeric()]

D. [check('username').notEmpty(), check('age').optional().isString()]

Solution

1. Step 1: Validate 'username' requirements

   Username is required and must have at least 3 characters, so use notEmpty() and isLength({ min: 3 }).

2. Step 2: Validate 'age' requirements

   Age is optional but if present must be numeric, so use optional() and isNumeric().

3. Final Answer:

   [check('username').isLength({ min: 3 }).notEmpty(), check('age').optional().isNumeric()] -> Option B

4. Quick Check:

   Required username + optional numeric age = [check('username').isLength({ min: 3 }).notEmpty(), check('age').optional().isNumeric()] [OK]

Hint: Use optional() for optional fields, notEmpty() for required [OK]

Common Mistakes:

• Marking required fields as optional
• Not chaining optional() before other checks
• Using wrong validators like isString() for numbers