Validating user input is crucial to your application and you should never trust the incoming request data. Please make sure you’re validating the provided user data before sending it to your database. You never know when a user tries to DROP TABLE users.
Within the related tutorials, you can see the usage of validation on each individual type: query parameters, path parameters, request payload and request headers. And within this guide, you’re going to combine all those types on a single route!
hapi Series Overview
- What You’ll Build
- Prepare Your Project: Stack & Structure
- Environment Variables and Storing Secrets
- Set Up MongoDB and Connect With Mongoose
- Sending Emails in Node.js
- Load the User’s Profile Picture From Gravatar Using Virtuals in Mongoose
- Implement a User Profile Editing Screen
- Generate a Username in Mongoose Middleware
- Displaying Seasons and Episodes for TV Shows with Mongoose Relationship Population
- Implementing Pagination for Movies
- Implement a Watchlist
- Create a Full Text Search with MongoDB
- Create a REST API with JSON Endpoints
- Update Mongoose Models for JSON Responses
- API Pagination for TV Shows
- Customize API Endpoints with Query Parameters
- Always Throw and Handle API Validation Errors
- Advanced API Validation With Custom Errors
- Create an API Documentation with Swagger
- Customize Your Swagger API Documentation URL
- Describe Endpoint Details in Your Swagger API Documentation
- 10 Tips on API Testing With Postman
- JWT Authentication in Swagger API Documentation
- API Versioning with Request Headers
- API Login With Username and Password to Generate a JWT
- JWT Authentication and Private API Endpoints
- Refresh Tokens With JWT Authentication
- Create a JWT Utility
- JWT Refresh Token for Multiple Devices
- Check Refresh Token in Authentication Strategy
- Rate Limit Your Refresh Token API Endpoint
- How to Revoke a JWT
- Invalidate JWTs With Blacklists
- JWT Logout (Part 1/2)
- JWT “Immediate” Logout (Part 2/2)
- A Better Place to Invalidate Tokens
- How to Switch the JWT Signing Algorithm
- Roll Your Own Refresh Token Authentication Scheme
- JWT Claims 101
- Use JWT With Asymmetric Signatures (RS256 & Co.)
- Encrypt the JWT Payload (The Simple Way)
- Increase JWT Security Beyond the Signature
- Unsigned JSON Web Tokens (Unsecured JWS)
- JWK and JWKS Overview
- Provide a JWKS API Endpoint
- Create a JWK from a Shared Secret
- JWT Verification via JWKS API Endpoint
- What is JOSE in JWT
- Encrypt a JWT (the JWE Way)
- Authenticate Encrypted JWTs (JWE)
- Encrypted and Signed JWT (Nested JWT)
- Bringing Back JWT Decoding and Authentication
- Bringing Back JWT Claims in the JWT Payload
- Basic Authentication With Username and Password
- Authentication and Remember Me Using Cookies
- How to Set a Default Authentication Strategy
- Define Multiple Authentication Strategies for a Route
- Restrict User Access With Scopes
- Show „Insufficient Scope“ View for Routes With Restricted Access
- Access Restriction With Dynamic and Advanced Scopes
- hapi - How to Fix „unknown authentication strategy“
- Authenticate with GitHub And Remember the Login
- Authenticate with GitLab And Remember the User
- How to Combine Bell With Another Authentication Strategy
- Custom OAuth Bell Strategy to Connect With any Server
- Redirect to Previous Page After Login
- How to Implement a Complete Sign Up Flow With Email and Password
- How to Implement a Complete Login Flow
- Implement a Password-Reset Flow
- Views in hapi 9 (and above)
- How to Render and Reply Views
- How to Reply and Render Pug Views (Using Pug 2.0)
- How to Create a Dynamic Handlebars Layout Template
- Create and Use Handlebars Partial Views
- Create and Use Custom Handlebars Helpers
- Specify a Different Handlebars Layout for a Specific View
- How to Create Jade-Like Layout Blocks in Handlebars
- Use Vue.js Mustache Tags in Handlebars Templates
- How to Use Multiple Handlebars Layouts
- How to Access and Handle Request Payload
- Access Request Headers
- How to Manage Cookies and HTTP States Across Requests
- Detect and Get the Client IP Address
- How to Upload Files
- Quick Access to Logged In User in Route Handlers
- How to Fix “handler method did not return a value, a promise, or throw an error”
- How to Fix “X must return an error, a takeover response, or a continue signal”
- Query Parameter Validation With Joi
- Path Parameter Validation With Joi
- Request Payload Validation With Joi
- Validate Query and Path Parameters, Payload and Headers All at Once on Your Routes
- Validate Request Headers With Joi
- Reply Custom View for Failed Validations
- Handle Failed Validations and Show Errors Details at Inputs
- How to Fix AssertionError, Cannot validate HEAD or GET requests
Prepare Your Project and Install Joi
To apply validation in hapi, you can and should use the joi module from within hapi’s plugin ecosystem. Joi allows you to define rules that get validated against the provided values. Before defining the validation itself, you need to add joi as a dependency to your project:
npm i -S joi
Installation process finished successfully? Your project is ready to make use of joi for data validation.
Validate All Incoming Request Data
Validation is built into the core of hapi and you can add a validate object to your route configuration including the specifications for the individual validation assignments, like query for query parameters, params for path parameters, and so on.
The following snippet illustrates the route setup including validation for the mentioned request data types: query, params, payload, headers
const Joi = require('joi')
server.route({
method: 'POST',
path: '/{page}',
config: {
handler: …,
validate: {
query: {
test: Joi.number().optional()
},
params: {
page: Joi.string().required()
},
payload: {
username: Joi.string().optional()
},
headers: {
'user-agent': Joi.string()
},
options: {
allowUnknown: true
}
}
}
})
The validate object is straight forward. Define a separate object for query, params, payload and headers and within those objects, provide the named parameters with their validation rules. Joi offers a simple to read and chainable interface with a rich API of configurations that can be applied!
Please remember that once you define validation rules for a named parameter like the user-agent in headers, it’s not possible to accept requests that contain other header fields, like host, accept-encoding, cache-control, etc. without setting validate.options.allowUnknown: true. Only requests with the single header field for user-agent pass the validation successfully without the option to allow additional and unknown properties! Please find more information in the linked joi documentation.
Outlook
This tutorial walked you through the setup of multiple types of validation to an individual route. Combine the validations freely as you’re adding routes to your hapi server.
During the last months, we’ve touched all types of validations for query and path parameters, request payload and request headers. You’re ready for the next level, which means that you should trim/sanitize/escape request parameters and payload. Don’t worry, we’ve got you covered in the upcoming tutorial!
We’re happy to hear your thoughts and comments. Please don’t hesitate to use the comments below or find us on Twitter @futurestud_io. Let us know what you think!
Enjoy coding & make it rock!