0Pricing
Node.js Backend Development Bootcamp · レッスン

Joi/Express-Validatorによる入力検証

Joiやexpress-validatorなどの強力なライブラリを使って受信データを検証し、データの整合性を確保します。

「Joi/Express-Validatorによる入力検証」はCoddyKit上の無料Node.js Backend Development Bootcampレッスンです。 これはレッスン3/4です。 下記で完全なレッスンを無料で読むことができます。その後、ブラウザ内の組み込みコードエディタと24時間対応のAIチューターでハンズオン演習できます。 これはNode.js Backend Development Bootcamp学習パスの一部であり、ウェブとCoddyKitアプリ全体で進捗が同期されます。 Node.js Backend Development Bootcampコースには全4レッスンが含まれています。

このレッスンの一部はまだ翻訳されておらず、英語で表示されています。

Why Validate Inputs?

Input validation is a critical security and data integrity practice. It ensures that data received by your application is clean, correct, and safe to process.

Without proper validation, your application becomes vulnerable to:

  • Security breaches: Like SQL injection or Cross-Site Scripting (XSS).
  • Data corruption: Malformed data can break your application or database.
  • Poor user experience: Inconsistent data leads to bugs and unexpected behavior.

Unvalidated Data: A Security Risk

Imagine a user submitting a form without validation. They could send:

  • Empty fields: Required information is missing.
  • Incorrect data types: A number field receives text.
  • Malicious scripts: Code designed to exploit your system.

Validation acts as a gatekeeper, preventing bad data from entering your application's core.

Joi: Define Your Data Shape

Joi is a powerful schema description language and data validator for JavaScript. It allows you to define the structure, type, and constraints of your data using a clear, chainable API.

Think of a Joi schema as a blueprint for your expected data. Any data that doesn't match this blueprint will be flagged as invalid.

Joi Schema in Action

Here's a simple Joi schema for a user's name and age. Try running it to see how validation works. Remember to install Joi first (npm install joi).

const Joi = require('joi');

const userSchema = Joi.object({
  username: Joi.string().alphanum().min(3).max(30).required(),
  age: Joi.number().integer().min(0).max(120).required()
});

async function runValidation() {
  const validUser = { username: 'john_doe', age: 30 };
  const invalidUser = { username: 'ab', age: 'twenty' };

  console.log('--- Valid User Test ---');
  try {
    const value = await userSchema.validateAsync(validUser);
    console.log('Validation successful for validUser!');
  } catch (err) {
    console.error('Validation failed for validUser:', err.details[0].message);
  }

  console.log('\n--- Invalid User Test ---');
  try {
    const value = await userSchema.validateAsync(invalidUser);
    console.log('Validation successful for invalidUser!');
  } catch (err) {
    console.error('Validation failed for invalidUser:', err.details[0].message);
  }
}

runValidation();

Joi in an Express Route

To use Joi in an Express.js application, you typically create a middleware function that performs the validation before the route handler is executed. This keeps your route handlers clean and focused on business logic.

const express = require('express');
const Joi = require('joi');
const app = express();
const port = 3000;

app.use(express.json()); // For parsing application/json

const userSchema = Joi.object({
  username: Joi.string().alphanum().min(3).max(30).required(),
  email: Joi.string().email().required(),
  password: Joi.string().min(6).required()
});

// Middleware to validate request body using Joi
const validateUser = (req, res, next) => {
  const { error } = userSchema.validate(req.body);
  if (error) {
    return res.status(400).send(error.details[0].message);
  }
  next(); // If validation passes, proceed to the route handler
};

app.post('/register', validateUser, (req, res) => {
  // If we reach here, req.body is valid
  res.status(201).send('User registered successfully!');
});

app.get('/', (req, res) => {
  res.send('Server is running. Try POST to /register with JSON data.');
});

app.listen(port, () => {
  console.log(`Server listening at http://localhost:${port}`);
  console.log('Try: POST http://localhost:3000/register with {\"username\":\"testuser\", \"email\":\"a@b.com\", \"password\":\"password123\"}');
  console.log('Or with invalid data: {\"username\":\"ab\", \"email\":\"a@b.com\"}');
});

Express-Validator: Middleware Power

Express-Validator is a set of Express.js middleware that wraps the powerful validator.js library. It focuses on validating and sanitizing data directly within the Express request cycle.

It's often favored for its seamless integration with Express routes, allowing you to chain multiple validation rules directly in your route definitions.

Express-Validator in Action

Here's how to use express-validator to validate an email and password directly within an Express route. Notice the check() function and validationResult(). Remember to install Express-Validator (npm install express-validator).

const express = require('express');
const { check, validationResult } = require('express-validator');
const app = express();
const port = 3000;

app.use(express.json());

app.post('/login', [
  check('email', 'Email is required').notEmpty(),
  check('email', 'Please include a valid email').isEmail(),
  check('password', 'Password must be 6 or more characters').isLength({ min: 6 })
], (req, res) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) {
    return res.status(400).json({ errors: errors.array() });
  }

  // If we reach here, req.body is valid
  res.send('User logged in successfully!');
});

app.get('/', (req, res) => {
  res.send('Server is running. Try POST to /login with JSON data.');
});

app.listen(port, () => {
  console.log(`Server listening at http://localhost:${port}`);
  console.log('Try: POST http://localhost:3000/login with {\"email\":\"user@example.com\", \"password\":\"password123\"}');
  console.log('Or with invalid data: {\"email\":\"bademail\", \"password\":\"123\"}');
});

Responding to Validation Errors

When validation fails, your API should return a clear, informative error message to the client. Both Joi and Express-Validator provide ways to extract these errors.

  • Joi: The error object contains details with specific messages.
  • Express-Validator: validationResult(req) aggregates all errors into an array, often including field names and messages.

Always return an appropriate HTTP status code, like 400 Bad Request, to indicate client-side input issues.

Joi vs. Express-Validator: Choose Wisely

Both libraries are excellent, but excel in different scenarios:

  • Joi: Ideal for complex, nested data structures. Great for defining a strict schema for your entire data model, often used for DTO (Data Transfer Object) validation.
  • Express-Validator: Perfect for quick, inline validation of request parameters (body, query, params) directly within your Express routes. Its middleware approach integrates seamlessly.

You can even use both! Joi for core data models, and Express-Validator for simpler route-specific checks.

Validation Check

Consider the following statements about input validation with Joi and Express-Validator:

Recap: Secure Your Inputs

Congratulations! You've learned the importance of input validation and how to implement it using two popular Node.js libraries:

  • Joi: For defining robust, schema-based validation rules for complex data.
  • Express-Validator: For lightweight, middleware-based validation directly within your Express routes.

Always validate incoming data to protect your application from vulnerabilities and ensure data integrity. Keep building secure and reliable APIs!

よくある質問

「Joi/Express-Validatorによる入力検証」レッスンは無料ですか？

はい。「Joi/Express-Validatorによる入力検証」の完全なテキストはこのウェブで無料で読めます。インタラクティブに演習し（組み込みコードエディタと24時間対応のAIチューター）、Node.js Backend Development Bootcampコースの残りをアンロックするには、CoddyKit PROにアップグレードしてください。 Node.js Backend Development Bootcampコースには全4レッスンが含まれています。

「Joi/Express-Validatorによる入力検証」で何を学びますか？

Joiやexpress-validatorなどの強力なライブラリを使って受信データを検証し、データの整合性を確保します。 ブラウザで直接実行するハンズオンコードでNode.js Backend Development Bootcampを演習し、24時間対応のAIチューターがレッスンを進める中での質問に答えます。

Node.js Backend Development Bootcampを始めるのに経験は必要ですか？

事前経験は必要ありません。CoddyKitのNode.js Backend Development Bootcampは初級者から上級者向けに構成されているため、ここから始めるか最初から始めて、自分のペースで進むことができます。 これはレッスン3/4です。

「Joi/Express-Validatorによる入力検証」レッスンにはどのくらい時間がかかりますか？

ほとんどのCoddyKitレッスンは約5～10分かかります。各レッスンはコンパクトでインタラクティブなので、着実に進歩し、ウェブとアプリ全体で正確に前回の場所から再開できます。

このNode.js Backend Development Bootcampレッスンでコードを書いて実行できますか？

はい。すべてのNode.js Backend Development Bootcampレッスンに組み込みコードエディタが含まれているため、ブラウザでリアルコードを書いて実行し、即座のAIフィードバックを取得できます。ローカル設定は不要です。

このコースのすべてのレッスン

  1. カスタムExpressミドルウェアを開発する
  2. グローバルエラー処理の戦略
  3. Joi/Express-Validatorによる入力検証
  4. JWTによる認証ミドルウェア
← Node.js Backend Development Bootcampに戻る