I was building an API last week, and a simple mistake brought the whole thing down. A user sent a string where a number should have been. It wasn’t malicious, just a typo in a form. But it crashed my server. That moment made me realize something critical: trusting user input is the fastest way to break your application. This is why I want to talk about a fundamental practice that separates a fragile API from a robust one. Let’s talk about validating every single request that comes in.
Think about it. Your Express routes are the front door to your application. Without a guard checking IDs at the door, anything can walk in. Manual checks inside each route handler work, but they turn your code into a mess of if statements. It’s repetitive, error-prone, and makes your core logic hard to find. There has to be a cleaner way.
This is where Joi comes in. Joi lets you describe exactly what your data should look like. It’s like writing a blueprint for your request. You define rules: “This field must be an email,” “That number must be between 1 and 100,” “This object is required.” You build a schema—a single source of truth for what valid data is.
The magic happens when you connect this blueprint to your Express routes. You add a small piece of middleware that says, “Before this route runs, check the incoming data against the Joi schema.” If the data fits, the request proceeds. If it doesn’t, the middleware stops the request right there and sends a helpful error back. Your route handler only ever sees clean, validated data. It’s a game-changer.
So, how do you actually do this? First, you need to install Joi. It’s straightforward.
npm install joiNow, let’s build a schema. Imagine you have a /register endpoint. You need a username, a valid email, and a password that meets certain rules. Here’s how you’d define that with Joi.
const Joi = require('joi');
const userSchema = Joi.object({
username: Joi.string().alphanum().min(3).max(30).required(),
email: Joi.string().email().required(),
password: Joi.string().pattern(new RegExp('^[a-zA-Z0-9]{8,30}$')).required(),
birth_year: Joi.number().integer().min(1900).max(2023)
});Look at that. In a few lines, we’ve set clear rules. The username must be alphanumeric and between 3 and 30 characters. The email must be a valid format. The password must match a specific pattern (here, 8-30 alphanumeric characters). The birth year is optional but must be a sensible number if provided. This is declarative and easy to read.
But a schema alone does nothing. We need to use it. You create a validation middleware function. This function takes a schema and decides which part of the request to validate (like req.body or req.params).
const validateRequest = (schema, property = 'body') => {
return (req, res, next) => {
const { error, value } = schema.validate(req[property], { abortEarly: false });
if (error) {
const errorMessage = error.details.map(detail => detail.message).join(', ');
return res.status(400).json({ error: errorMessage });
}
// Replace the request data with the validated (and possibly sanitized) value
req[property] = value;
next();
};
};Notice the abortEarly: false option? This tells Joi to check all the fields and report back every single error, not just the first one it finds. It’s much better for the user experience. They can fix all their mistakes at once.
Now, using it in a route is beautifully simple.
const express = require('express');
const router = express.Router();
router.post('/register', validateRequest(userSchema, 'body'), (req, res) => {
// At this point, req.body is guaranteed to be valid!
const { username, email } = req.body;
// Proceed with user creation logic...
res.json({ message: `User ${username} created successfully.` });
});See how clean the route handler is? No validation logic in sight. It just focuses on its job. The middleware handled the security and data integrity. What if you need to validate a URL parameter, like a user ID?
const idSchema = Joi.object({
id: Joi.string().length(24).hex().required() // Validates a MongoDB-like ObjectId
});
router.get('/user/:id', validateRequest(idSchema, 'params'), (req, res) => {
// Safe to use req.params.id
res.json({ userId: req.params.id });
});This pattern is incredibly powerful. It standardizes error responses, makes your API predictable, and drastically reduces bugs. It also sanitizes data. Joi can convert types—like turning a string "25" into the number 25 if your schema expects a number. This means your handlers work with the correct data types from the start.
Have you considered what happens when your validation rules need to change? With this setup, you only update the schema in one place. Every route using that schema automatically gets the new rules. It makes maintenance a breeze.
The benefits go beyond clean code. It’s a security barrier. It prevents malformed data from triggering unexpected behavior in your database or business logic. It protects against a whole class of common errors. Your API becomes self-documenting too; the schemas clearly show what each endpoint expects.
Start small. Pick one POST route in your current project and add Joi validation. You’ll immediately feel the difference. Your handler will become simpler, and you’ll gain confidence that the data is correct. Then, gradually apply it everywhere. It’s one of those practices that, once adopted, you’ll wonder how you ever built APIs without it.
Building reliable software is about expecting the unexpected. Users will always find new ways to send you strange data. By using Express with Joi, you stop fighting that reality and instead build a system that gracefully handles it. Your future self, debugging at 2 AM, will thank you. Your users will appreciate the clear error messages. And your application will stand on a much firmer foundation.
Did this approach to validation change how you think about handling requests? I’d love to hear about your experiences or any tips you have. If you found this useful, please share it with another developer who might be wrestling with messy validation logic. Drop a comment below and let’s discuss how to build more resilient APIs together.
As a best-selling author, I invite you to explore my books on Amazon. Don’t forget to follow me on Medium and show your support. Thank you! Your support means the world!
101 Books
101 Books is an AI-driven publishing company co-founded by author Aarav Joshi. By leveraging advanced AI technology, we keep our publishing costs incredibly low—some books are priced as low as $4—making quality knowledge accessible to everyone.
Check out our book Golang Clean Code available on Amazon.
Stay tuned for updates and exciting news. When shopping for books, search for Aarav Joshi to find more of our titles. Use the provided link to enjoy special discounts!
📘 Checkout my latest ebook for free on my channel!
Be sure to like, share, comment, and subscribe to the channel!
Our Creations
Be sure to check out our creations:
Investor Central | Investor Central Spanish | Investor Central German | Smart Living | Epochs & Echoes | Puzzling Mysteries | Hindutva | Elite Dev | JS Schools
We are on Medium
Tech Koala Insights | Epochs & Echoes World | Investor Central Medium | Puzzling Mysteries Medium | Science & Epochs Medium | Modern Hindutva
