Node.js Backend Development Bootcamp · Lezione

Convalida degli input con Joi/Express-Validator

Convalidi i dati delle richieste in ingresso utilizzando librerie potenti come Joi o express-validator, per garantire l’integrità dei dati.

Convalida degli input con Joi/Express-Validator è una lezione Node.js Backend Development Bootcamp gratuita su CoddyKit. Questa è la lezione 3 di 4. Puoi leggere la lezione completa qui gratuitamente — poi esercitati direttamente nel browser con un editor di codice integrato e un tutor IA disponibile 24/7. Fa parte del percorso di apprendimento Node.js Backend Development Bootcamp, e i tuoi progressi si sincronizzano tra il web e l'app CoddyKit. Il corso Node.js Backend Development Bootcamp include 4 lezioni in totale.

Parti di questa lezione non sono ancora state tradotte e vengono mostrate in inglese.

Why Validate Inputs?

Input validation is a critical security and data integrity practice. It ensures that data received by your application is clean, correct, and safe to process.

Without proper validation, your application becomes vulnerable to:

Security breaches: Like SQL injection or Cross-Site Scripting (XSS).
Data corruption: Malformed data can break your application or database.
Poor user experience: Inconsistent data leads to bugs and unexpected behavior.

Unvalidated Data: A Security Risk

Imagine a user submitting a form without validation. They could send:

Empty fields: Required information is missing.
Incorrect data types: A number field receives text.
Malicious scripts: Code designed to exploit your system.

Validation acts as a gatekeeper, preventing bad data from entering your application's core.

Joi: Define Your Data Shape

Joi is a powerful schema description language and data validator for JavaScript. It allows you to define the structure, type, and constraints of your data using a clear, chainable API.

Think of a Joi schema as a blueprint for your expected data. Any data that doesn't match this blueprint will be flagged as invalid.

Joi Schema in Action

Here's a simple Joi schema for a user's name and age. Try running it to see how validation works. Remember to install Joi first (npm install joi).

const Joi = require('joi');

const userSchema = Joi.object({
  username: Joi.string().alphanum().min(3).max(30).required(),
  age: Joi.number().integer().min(0).max(120).required()
});

async function runValidation() {
  const validUser = { username: 'john_doe', age: 30 };
  const invalidUser = { username: 'ab', age: 'twenty' };

  console.log('--- Valid User Test ---');
  try {
    const value = await userSchema.validateAsync(validUser);
    console.log('Validation successful for validUser!');
  } catch (err) {
    console.error('Validation failed for validUser:', err.details[0].message);
  }

  console.log('\n--- Invalid User Test ---');
  try {
    const value = await userSchema.validateAsync(invalidUser);
    console.log('Validation successful for invalidUser!');
  } catch (err) {
    console.error('Validation failed for invalidUser:', err.details[0].message);
  }
}

runValidation();

Joi in an Express Route

To use Joi in an Express.js application, you typically create a middleware function that performs the validation before the route handler is executed. This keeps your route handlers clean and focused on business logic.

const express = require('express');
const Joi = require('joi');
const app = express();
const port = 3000;

app.use(express.json()); // For parsing application/json

const userSchema = Joi.object({
  username: Joi.string().alphanum().min(3).max(30).required(),
  email: Joi.string().email().required(),
  password: Joi.string().min(6).required()
});

// Middleware to validate request body using Joi
const validateUser = (req, res, next) => {
  const { error } = userSchema.validate(req.body);
  if (error) {
    return res.status(400).send(error.details[0].message);
  }
  next(); // If validation passes, proceed to the route handler
};

app.post('/register', validateUser, (req, res) => {
  // If we reach here, req.body is valid
  res.status(201).send('User registered successfully!');
});

app.get('/', (req, res) => {
  res.send('Server is running. Try POST to /register with JSON data.');
});

app.listen(port, () => {
  console.log(`Server listening at http://localhost:${port}`);
  console.log('Try: POST http://localhost:3000/register with {\"username\":\"testuser\", \"email\":\"a@b.com\", \"password\":\"password123\"}');
  console.log('Or with invalid data: {\"username\":\"ab\", \"email\":\"a@b.com\"}');
});

Express-Validator: Middleware Power

Express-Validator is a set of Express.js middleware that wraps the powerful validator.js library. It focuses on validating and sanitizing data directly within the Express request cycle.

It's often favored for its seamless integration with Express routes, allowing you to chain multiple validation rules directly in your route definitions.

Express-Validator in Action

Here's how to use express-validator to validate an email and password directly within an Express route. Notice the check() function and validationResult(). Remember to install Express-Validator (npm install express-validator).

const express = require('express');
const { check, validationResult } = require('express-validator');
const app = express();
const port = 3000;

app.use(express.json());

app.post('/login', [
  check('email', 'Email is required').notEmpty(),
  check('email', 'Please include a valid email').isEmail(),
  check('password', 'Password must be 6 or more characters').isLength({ min: 6 })
], (req, res) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) {
    return res.status(400).json({ errors: errors.array() });
  }

  // If we reach here, req.body is valid
  res.send('User logged in successfully!');
});

app.get('/', (req, res) => {
  res.send('Server is running. Try POST to /login with JSON data.');
});

app.listen(port, () => {
  console.log(`Server listening at http://localhost:${port}`);
  console.log('Try: POST http://localhost:3000/login with {\"email\":\"user@example.com\", \"password\":\"password123\"}');
  console.log('Or with invalid data: {\"email\":\"bademail\", \"password\":\"123\"}');
});

Responding to Validation Errors

When validation fails, your API should return a clear, informative error message to the client. Both Joi and Express-Validator provide ways to extract these errors.

Joi: The error object contains details with specific messages.
Express-Validator: validationResult(req) aggregates all errors into an array, often including field names and messages.

Always return an appropriate HTTP status code, like 400 Bad Request, to indicate client-side input issues.

Joi vs. Express-Validator: Choose Wisely

Both libraries are excellent, but excel in different scenarios:

Joi: Ideal for complex, nested data structures. Great for defining a strict schema for your entire data model, often used for DTO (Data Transfer Object) validation.
Express-Validator: Perfect for quick, inline validation of request parameters (body, query, params) directly within your Express routes. Its middleware approach integrates seamlessly.

You can even use both! Joi for core data models, and Express-Validator for simpler route-specific checks.

Validation Check

Consider the following statements about input validation with Joi and Express-Validator:

Recap: Secure Your Inputs

Congratulations! You've learned the importance of input validation and how to implement it using two popular Node.js libraries:

Joi: For defining robust, schema-based validation rules for complex data.
Express-Validator: For lightweight, middleware-based validation directly within your Express routes.

Always validate incoming data to protect your application from vulnerabilities and ensure data integrity. Keep building secure and reliable APIs!

Domande Frequenti

La lezione «Convalida degli input con Joi/Express-Validator» è gratuita?

Sì — il testo completo di «Convalida degli input con Joi/Express-Validator» è gratuito qui sul web. Per esercitarvi in modo interattivo (un editor di codice integrato e un tutor IA 24/7) e sbloccare il resto del corso Node.js Backend Development Bootcamp, passa a CoddyKit PRO. Il corso Node.js Backend Development Bootcamp include 4 lezioni in totale.

Cosa imparerò in «Convalida degli input con Joi/Express-Validator»?

Convalidi i dati delle richieste in ingresso utilizzando librerie potenti come Joi o express-validator, per garantire l’integrità dei dati. Eserciti Node.js Backend Development Bootcamp con codice pratico che esegui direttamente nel browser, e un tutor IA 24/7 risponde alle tue domande mentre lavori sulla lezione.

Ho bisogno di esperienza per iniziare Node.js Backend Development Bootcamp?

Non è richiesta alcuna esperienza precedente. Node.js Backend Development Bootcamp su CoddyKit è strutturato per principianti e studenti avanzati, quindi puoi iniziare da qui o dall'inizio e procedere al tuo ritmo. Questa è la lezione 3 di 4.

Quanto tempo richiede la lezione «Convalida degli input con Joi/Express-Validator»?

La maggior parte delle lezioni CoddyKit richiede circa 5–10 minuti. Ogni lezione è breve e interattiva, quindi fai progressi costanti e riprendi esattamente da dove hai lasciato su web e app.

Posso scrivere ed eseguire codice in questa lezione Node.js Backend Development Bootcamp?

Sì. Ogni lezione Node.js Backend Development Bootcamp include un editor di codice integrato, quindi scrivi ed esegui codice reale direttamente nel tuo browser e ricevi feedback istantaneo dall'IA — nessuna configurazione locale necessaria.

Tutte le lezioni di questo corso

Sviluppare middleware Express personalizzati
Strategie globali di gestione degli errori
Convalida degli input con Joi/Express-Validator
Middleware di autenticazione con JWT

← Torna a Node.js Backend Development Bootcamp