Request validation in Node.js - Step-by-Step Execution

Concept Flow - Request validation

Receive HTTP Request

↓

Extract Request Data

↓

Validate Data Against Rules

↓

Process Request

↓

Send Response

The server receives a request, extracts data, checks if it meets rules, then either processes it or returns an error.

Execution Sample

Node.js

import express from 'express';
import { body, validationResult } from 'express-validator';

const app = express();
app.use(express.json());

app.post('/user', [
  body('email').isEmail(),
  body('age').isInt({ min: 18 })
], (req, res) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) {
    return res.status(400).json({ errors: errors.array() });
  }
  res.send('User data is valid');
});

This code checks if the email is valid and age is at least 18 before accepting user data.

Execution Table

Step	Action	Input Data	Validation Result	Response
1	Receive POST /user	{ email: '[e-mail]', age: 20 }	Pending	Pending
2	Check email is valid	[e-mail]	Valid	Pending
3	Check age >= 18	20	Valid	Pending
4	All validations passed?	Yes	Pass	Send 200 OK with 'User data is valid'
5	End	-	-	Response sent, request complete
6	Receive POST /user	{ email: 'bademail', age: 16 }	Pending	Pending
7	Check email is valid	bademail	Invalid	Pending
8	Check age >= 18	16	Invalid	Pending
9	All validations passed?	No	Fail	Send 400 Bad Request with errors
10	End	-	-	Response sent, request complete

💡 Execution stops after sending response based on validation success or failure.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4
req.body	{}	{ email: '[e-mail]', age: 20 }	{ email: '[e-mail]', age: 20 }	{ email: '[e-mail]', age: 20 }
errors	empty	empty	empty	empty (no errors)
response.status	unset	unset	unset	200
response.body	unset	unset	unset	'User data is valid'

Key Moments - 2 Insights

Why does the server return an error if one validation fails even if others pass?

Because the validationResult checks all rules and if any fail, it returns errors immediately, as shown in steps 7-9 where both email and age fail and the response is 400.

What happens if the request body is missing a field like 'age'?

The validation for 'age' will fail because isInt requires a number, so validationResult will catch this and return an error response, similar to the failure path in the execution table.

Visual Quiz - 3 Questions

Look at the execution table, what is the validation result for age at step 3 when age is 20?

A Invalid

B Pending

C Valid

D Not checked

💡 Hint

Check the 'Validation Result' column at step 3 in the execution_table.

At which step does the server decide to send a 400 Bad Request response?

A Step 9

B Step 4

C Step 5

D Step 2

💡 Hint

Look for the step where 'Response' shows 'Send 400 Bad Request' in the execution_table.

If the email field is missing, how would the validation result change at step 2?

A It would be Valid

B It would be Invalid

C It would be Pending

D It would be Skipped

💡 Hint

Missing required fields cause validation to fail, similar to step 7 in the execution_table.

Concept Snapshot

Request validation in Node.js:
- Extract data from request (req.body)
- Use validation rules (e.g., isEmail, isInt)
- Check results with validationResult()
- If errors exist, send 400 response with details
- Else, process request normally

Full Transcript

Request validation in Node.js means checking incoming data before using it. The server gets a request, takes the data, and checks if it meets rules like 'email must be valid' or 'age must be at least 18'. If all checks pass, the server processes the request and sends a success message. If any check fails, it sends back an error message explaining what is wrong. This helps keep the app safe and working well by not accepting bad data.

Practice

1. What is the main purpose of request validation in a Node.js app?

easy

A. To store data in the database

B. To speed up the server response time

C. To check incoming data before using it

D. To create new routes automatically

Solution

1. Step 1: Understand request validation

   Request validation means checking the data sent by users before the app uses it.

2. Step 2: Identify the main goal

   The goal is to ensure data is safe and correct to avoid errors or security issues.

3. Final Answer:

   To check incoming data before using it -> Option C

4. Quick Check:

   Request validation = check data first [OK]

Hint: Validation means checking data before use [OK]

Common Mistakes:

• Thinking validation speeds up server
• Confusing validation with data storage
• Assuming validation creates routes

2. Which code snippet correctly uses express-validator to check if 'email' is valid?

easy

A. validateEmail('email').isValid()

B. validate('email').isEmail()

C. checkEmail('email').validate()

D. check('email').isEmail()

Solution

1. Step 1: Recall express-validator syntax

   express-validator uses check('fieldName').validationMethod() to validate fields.

2. Step 2: Match correct method for email

   The method is isEmail() to check if the input is a valid email.

3. Final Answer:

   check('email').isEmail() -> Option D

4. Quick Check:

   express-validator uses check() + isEmail() [OK]

Hint: Use check('field').isEmail() for email validation [OK]

Common Mistakes:

• Using validate() instead of check()
• Wrong method names like validateEmail()
• Mixing method order or names

3. Given this code, what will be the output if the request body has { email: 'not-an-email' }?

app.post('/signup', [
  check('email').isEmail(),
  (req, res) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }
    res.send('Success');
  }
]);

medium

A. Response with status 400 and error details

B. Response with 'Success' message

C. Server crashes with an error

D. Response with status 200 and empty body

Solution

1. Step 1: Check validation rule

   The rule check('email').isEmail() requires a valid email format.

2. Step 2: Analyze input and error handling

   The input 'not-an-email' fails isEmail(), so errors.isEmpty() is false, triggering status 400 with error details.

3. Final Answer:

   Response with status 400 and error details -> Option A

4. Quick Check:

   Invalid email triggers 400 error [OK]

Hint: Invalid input triggers 400 error with details [OK]

Common Mistakes:

• Assuming success response on invalid input
• Expecting server crash on validation fail
• Ignoring error handling logic

4. Identify the error in this validation middleware:

app.post('/login', [
  check('password').isLength({ min: 6 }),
  (req, res) => {
    const errors = validationResult;
    if (!errors.isEmpty()) {
      return res.status(422).json({ errors: errors.array() });
    }
    res.send('Logged in');
  }
]);

medium

A. validationResult is not called with req, so errors is not an object with isEmpty()

B. isLength should be isMinLength for password check

C. Missing next() call to continue middleware chain

D. Response status 422 is invalid for validation errors

Solution

1. Step 1: Check usage of validationResult

   validationResult must be called as validationResult(req) to get errors from the request.

2. Step 2: Identify the mistake in code

   The code assigns errors = validationResult without calling it, so errors is not an object with isEmpty().

3. Final Answer:

   validationResult is not called with req, so errors is not an object with isEmpty() -> Option A

4. Quick Check:

   Call validationResult(req) to get errors [OK]

Hint: Always call validationResult(req) to get errors [OK]

Common Mistakes:

• Forgetting to call validationResult as a function
• Using wrong validation method names
• Confusing middleware flow with next()

5. You want to validate a request body with fields 'username' (required, min 3 chars) and 'age' (optional, must be a number if present). Which express-validator setup is correct?

hard

A. [check('username').optional().isLength({ min: 3 }), check('age').isNumeric()]

B. [check('username').isLength({ min: 3 }).notEmpty(), check('age').optional().isNumeric()]

C. [check('username').isLength({ min: 3 }), check('age').notEmpty().isNumeric()]

D. [check('username').notEmpty(), check('age').optional().isString()]

Solution

1. Step 1: Validate 'username' requirements

   Username is required and must have at least 3 characters, so use notEmpty() and isLength({ min: 3 }).

2. Step 2: Validate 'age' requirements

   Age is optional but if present must be numeric, so use optional() and isNumeric().

3. Final Answer:

   [check('username').isLength({ min: 3 }).notEmpty(), check('age').optional().isNumeric()] -> Option B

4. Quick Check:

   Required username + optional numeric age = [check('username').isLength({ min: 3 }).notEmpty(), check('age').optional().isNumeric()] [OK]

Hint: Use optional() for optional fields, notEmpty() for required [OK]

Common Mistakes:

• Marking required fields as optional
• Not chaining optional() before other checks
• Using wrong validators like isString() for numbers