Smart Node.js Form Validation

Smart Node.js Form Validation

Bulletproof Node.js form validation is fundamental to implementing a back-end API, and the datalize JavaScript validation library makes it easy.

Bulletproof Node.js form validation is fundamental to implementing a back-end API, and the datalize JavaScript validation library makes it easy.

One of the fundamental tasks to perform in an API is data validation. In this article, I’d like to show you how to add bulletproof validation for your data in a way that also returns it nicely formatted.

Doing custom data validation in Node.js is neither easy nor quick. There’s a lot of functionality you need to write in order to cover any kind of data. While I’ve tried a few Node.js form data libraries—for both Express and Koa—they’ve never fulfilled the needs of my projects. There were problems with extending libraries and the libraries not working with complex data structures or asynchronous validation.

Form Validation in Node.js with Datalize

That’s why I eventually decided to write my own tiny-but-powerful form validation library called datalize. It’s extendable, so you can use it in any project and customize it to your requirements. It validates a request’s body, query, or params. It also supports async filters and complex JSON structures like arrays or nested objects.

Setup

Datalize can be installed via npm:

npm install --save datalize


To parse a request’s body, you should use a separate library. If you don’t already use one, I recommend koa-body for Koa or body-parser for Express.

You can apply this tutorial to your already-set-up HTTP API server, or use the following simple Koa HTTP server code.

const Koa = require('koa');
const bodyParser = require('koa-body');

const app = new Koa();
const router = new (require('koa-router'))();

// helper for returning errors in routes
app.context.error = function(code, obj) {
this.status = code;
this.body = obj;
};

// add koa-body middleware to parse JSON and form-data body
app.use(bodyParser({
enableTypes: ['json', 'form'],
multipart: true,
formidable: {
maxFileSize: 32 * 1024 * 1024,
}
}));

// Routes...

// connect defined routes as middleware to Koa
app.use(router.routes());
// our app will listen on port 3000
app.listen(3000);

console.log('🌍 API listening on 3000');


However, this is not a production setup (you should use logging, enforce authorization, handle errors, etc.), but these few lines of code will work just fine for the examples I’ll show you.

Note: All code examples use Koa, but the data validation code will work for Express as well. The datalize library also has an example for implementing Express form validation.

A Basic Node.js Form Validation Example

Let’s say you have a Koa or Express web server and an endpoint in your API that creates a user with several fields in the database. Some fields are required, and some can only have specific values or must be formatted to correct type.

You could write simple logic like this:

/**
 * @api {post} / Create a user
 * ...
 */
router.post('/', (ctx) => {
	const data = ctx.request.body;
	const errors = {};

	if (!String(data.name).trim()) {
		errors.name = ['Name is required'];
	}

	if (!(/^[\-0-9a-zA-Z\.\+_][email protected][\-0-9a-zA-Z\.\+_]+\.[a-zA-Z]{2,}$/).test(String(data.email))) {
		errors.email = ['Email is not valid.'];
	}

	if (Object.keys(errors).length) {
		return ctx.error(400, {errors});
	}

	const user = await User.create({
			name: data.name,
			email: data.email,
	});

	ctx.body = user.toJSON();
});


Now let’s rewrite this code and validate this request using datalize:

const datalize = require('datalize');
const field = datalize.field;

/**
 * @api {post} / Create a user
 * ...
 */
router.post('/', datalize([
	field('name').trim().required(),
	field('email').required().email(),
]), (ctx) => {
	if (!ctx.form.isValid) {
		return ctx.error(400, {errors: ctx.form.errors});
	}

	const user = await User.create(ctx.form);

	ctx.body = user.toJSON();
});


Shorter, cleaner, so easy to read. With datalize, you can specify a list of fields and chain to them as many rules (functions that throw an error if the input is invalid) or filters (functions that format the input) as you want.

The rules and filters are executed in the same order as they’re defined, so if you want to trim a string for whitespace first and then check if it has any value, you have to define .trim() before .required().

Datalize will then create an object (available as .form in the wider context object) with just the fields you have specified, so you don’t have to list them again. The .form.isValid property tells you whether validation was successful or not.

Automatic Error Handling

If we don’t want to check whether the form is valid or not with every request, we can add a global middleware which cancels the request if the data didn’t pass validation.

To do this we just add this piece of code to our bootstrap file where we create our Koa/Express app instance.

const datalize = require('datalize');

// set datalize to throw an error if validation fails
datalize.set('autoValidate', true);

// only Koa
// add to very beginning of Koa middleware chain
app.use(async (ctx, next) => {
	try {
		await next();
	} catch (err) {
		if (err instanceof datalize.Error) {
			ctx.status = 400;
			ctx.body = err.toJSON();
		} else {
			ctx.status = 500;
			ctx.body = 'Internal server error';
		}
	}
});

// only Express
// add to very end of Express middleware chain
app.use(function(err, req, res, next) {
	if (err instanceof datalize.Error) {
		res.status(400).send(err.toJSON());
	} else {
		res.send(500).send('Internal server error');
	}
});


And we don’t have to check if data is valid anymore, as datalize will do it for us. If the data is invalid, it will return a formatted error message with a list of invalid fields.

Query Validation

Yes, you can even validate your query parameters very easily—it doesn’t have to be used with POST requests only. We just use the .query() helper method, and the only difference is that the data is stored in the .data object instead of .form.

const datalize = require('datalize');
const field = datalize.field;

/**
 * @api {get} / List users
 * ...
 */
router.post('/', datalize.query([
	field('keywords').trim(),
	field('page').default(1).number(),
	field('perPage').required().select([10, 30, 50]),
]), (ctx) => {
	const limit = ctx.data.perPage;
	const where = {
	};

	if (ctx.data.keywords) {
		where.name = {[Op.like]: ctx.data.keywords + '%'};
	}

	const users = await User.findAll({
		where,
		limit,
		offset: (ctx.data.page - 1) * limit,
	});

	ctx.body = users;
});


There is also a helper method for parameter validation, .params(). Query and form data can be validated together by passing two datalize middlewares in the router’s .post() method.

More Filters, Arrays, and Nested Objects

So far we’ve used really simple data in our Node.js form validation. Now let’s try some more complex fields like arrays, nested objects, etc.:

const datalize = require('datalize');
const field = datalize.field;
const DOMAIN_ERROR = "Email's domain does not have a valid MX (mail) entry in its DNS record";

/**
 * @api {post} / Create a user
 * ...
 */
router.post('/', datalize([
	field('name').trim().required(),
	field('email').required().email().custom((value) => {
		return new Promise((resolve, reject) => {
			dns.resolve(value.split('@')[1], 'MX', function(err, addresses) {
				if (err || !addresses || !addresses.length) {
					return reject(new Error(DOMAIN_ERROR));
				}

				resolve();
			});
		});
	}),
	field('type').required().select(['admin', 'user']),
	field('languages').array().container([
		field('id').required().id(),
		field('level').required().select(['beginner', 'intermediate', 'advanced'])
	]),
	field('groups').array().id(),
]), async (ctx) => {
	const {languages, groups} = ctx.form;
	delete ctx.form.languages;
	delete ctx.form.groups;

	const user = await User.create(ctx.form);

	await UserGroup.bulkCreate(groups.map(groupId => ({
		groupId,
		userId: user.id,
	})));

	await UserLanguage.bulkCreate(languages.map(item => ({
		languageId: item.id,
		userId: user.id,
		level: item.level,
	));
});


If there is no built-in rule for data we need to validate, we can create a custom data validation rule with the .custom() method (great name, right?) and write the necessary logic there. For nested objects, there is the .container() method in which you can specify a list of fields the same way as in the datalize() function. You can nest containers within containers or supplement them with .array() filters, which converts values to arrays. When the .array() filter is used without a container, the specified rules or filters are applied to every value in the array.

So .array().select(['read', 'write']) would check if every value in the array is either 'read' or 'write' and if any are not, it will return a list of all indexes with errors. Pretty cool, huh?

PUT/PATCH

When it comes to updating your data with PUT/PATCH (or POST), you don’t have to rewrite all your logic, rules, and filters. You just add an extra filter like .optional() or .patch(), which will remove any field from the context object if it was not defined in the request. (.optional() will make it always optional, whereas .patch() will make it optional only if the HTTP request’s method is PATCH.) You can add this extra filter so it works for both creating and updating data in your database.

const datalize = require('datalize');
const field = datalize.field;

const userValidator = datalize([
	field('name').patch().trim().required(),
	field('email').patch().required().email(),
	field('type').patch().required().select(['admin', 'user']),
]);

const userEditMiddleware = async (ctx, next) => {
	const user = await User.findByPk(ctx.params.id);

	// cancel request here if user was not found
	if (!user) {
		throw new Error('User was not found.');
	}

	// store user instance in the request so we can use it later
	ctx.user = user;

	return next();
};

/**
 * @api {post} / Create a user
 * ...
 */
router.post('/', userValidator, async (ctx) => {
	const user = await User.create(ctx.form);

	ctx.body = user.toJSON();
});

/**
 * @api {put} / Update a user
 * ...
 */
router.put('/:id', userEditMiddleware, userValidator, async (ctx) => {
	await ctx.user.update(ctx.form);

	ctx.body = ctx.user.toJSON();
});

/**
 * @api {patch} / Patch a user
 * ...
 */
router.patch('/:id', userEditMiddleware, userValidator, async (ctx) => {
	if (!Object.keys(ctx.form).length) {
		return ctx.error(400, {message: 'Nothing to update.'});
	}

	await ctx.user.update(ctx.form);

	ctx.body = ctx.user.toJSON();
});


With two simple middlewares, we can write most logic for all POST/PUT/PATCH methods. The userEditMiddleware() function verifies if the record that we want to edit exists and throws an error otherwise. Then userValidator() does the validation for all endpoints. Finally, the .patch() filter will remove any field from the .form object if it’s not defined and if the request’s method is PATCH.

Node.js Form Validation Extras

In custom filters, you can get values of other fields and perform validation based on that. You can also get any data from the context object, like request or user information, as it’s all provided in custom function callback parameters.

The library covers a basic set of rules and filters, but you can register custom global filters that you can use with any fields, so you don’t have to write the same code over and over:

const datalize = require('datalize');
const Field = datalize.Field;

Field.prototype.date = function(format = 'YYYY-MM-DD') {
  return this.add(function(value) {
    const date = value ? moment(value, format) : null;

    if (!date || !date.isValid()) {
      throw new Error('%s is not a valid date.');
    }

    return date.format(format);
  });
};

Field.prototype.dateTime = function(format = 'YYYY-MM-DD HH:mm') {
  return this.date(format);
};


With these two custom filters you can chain your fields with .date() or .dateTime() filters to validate date input.

Files can also be validated using datalize: There are special filters just for files like .file(), .mime(), and .size() so you don’t have to handle files separately.

Start Writing Better APIs Now

I’ve been using datalize for Node.js form validation in several production projects already, for both small and large APIs. It’s helped me to deliver great projects on time and with less stress while making them more readable and maintainable. On one project I’ve even used it to validate data for WebSocket messages by writing a simple wrapper around Socket.IO and the usage was pretty much the same as defining routes in Koa, so that was nice. If there is enough interest, I might write a tutorial for that as well.

I hope this tutorial will help you and I build better APIs in Node.js, with perfectly validated data without security issues or internal server errors. And most importantly, I hope it will save you a ton of time that you would otherwise have to invest in writing extra functions for form validation using JavaScript.

How to Use Express.js, Node.js and MongoDB.js

How to Use Express.js, Node.js and MongoDB.js

In this post, I will show you how to use Express.js, Node.js and MongoDB.js. We will be creating a very simple Node application, that will allow users to input data that they want to store in a MongoDB database. It will also show all items that have been entered into the database.

In this post, I will show you how to use Express.js, Node.js and MongoDB.js. We will be creating a very simple Node application, that will allow users to input data that they want to store in a MongoDB database. It will also show all items that have been entered into the database.

Creating a Node Application

To get started I would recommend creating a new database that will contain our application. For this demo I am creating a directory called node-demo. After creating the directory you will need to change into that directory.

mkdir node-demo
cd node-demo

Once we are in the directory we will need to create an application and we can do this by running the command
npm init

This will ask you a series of questions. Here are the answers I gave to the prompts.

The first step is to create a file that will contain our code for our Node.js server.

touch app.js

In our app.js we are going to add the following code to build a very simple Node.js Application.

var express = require("express");
var app = express();
var port = 3000;
 
app.get("/", (req, res) => {
  res.send("Hello World");
});
 
app.listen(port, () => {
  console.log("Server listening on port " + port);
});

What the code does is require the express.js application. It then creates app by calling express. We define our port to be 3000.

The app.use line will listen to requests from the browser and will return the text “Hello World” back to the browser.

The last line actually starts the server and tells it to listen on port 3000.

Installing Express

Our app.js required the Express.js module. We need to install express in order for this to work properly. Go to your terminal and enter this command.

npm install express --save

This command will install the express module into our package.json. The module is installed as a dependency in our package.json as shown below.

To test our application you can go to the terminal and enter the command

node app.js

Open up a browser and navigate to the url http://localhost:3000

You will see the following in your browser

Creating Website to Save Data to MongoDB Database

Instead of showing the text “Hello World” when people view your application, what we want to do is to show a place for user to save data to the database.

We are going to allow users to enter a first name and a last name that we will be saving in the database.

To do this we will need to create a basic HTML file. In your terminal enter the following command to create an index.html file.

touch index.html

In our index.html file we will be creating an input filed where users can input data that they want to have stored in the database. We will also need a button for users to click on that will add the data to the database.

Here is what our index.html file looks like.

<!DOCTYPE html>
<html>
  <head>
    <title>Intro to Node and MongoDB<title>
  <head>

  <body>
    <h1>Into to Node and MongoDB<&#47;h1>
    <form method="post" action="/addname">
      <label>Enter Your Name<&#47;label><br>
      <input type="text" name="firstName" placeholder="Enter first name..." required>
      <input type="text" name="lastName" placeholder="Enter last name..." required>
      <input type="submit" value="Add Name">
    </form>
  <body>
<html>

If you are familiar with HTML, you will not find anything unusual in our code for our index.html file. We are creating a form where users can input their first name and last name and then click an “Add Name” button.

The form will do a post call to the /addname endpoint. We will be talking about endpoints and post later in this tutorial.

Displaying our Website to Users

We were previously displaying the text “Hello World” to users when they visited our website. Now we want to display our html file that we created. To do this we will need to change the app.use line our our app.js file.

We will be using the sendFile command to show the index.html file. We will need to tell the server exactly where to find the index.html file. We can do that by using a node global call __dirname. The __dirname will provide the current directly where the command was run. We will then append the path to our index.html file.

The app.use lines will need to be changed to
app.use("/", (req, res) => {   res.sendFile(__dirname + "/index.html"); });

Once you have saved your app.js file, we can test it by going to terminal and running node app.js

Open your browser and navigate to “http://localhost:3000”. You will see the following

Connecting to the Database

Now we need to add our database to the application. We will be connecting to a MongoDB database. I am assuming that you already have MongoDB installed and running on your computer.

To connect to the MongoDB database we are going to use a module called Mongoose. We will need to install mongoose module just like we did with express. Go to your terminal and enter the following command.
npm install mongoose --save

This will install the mongoose model and add it as a dependency in our package.json.

Connecting to the Database

Now that we have the mongoose module installed, we need to connect to the database in our app.js file. MongoDB, by default, runs on port 27017. You connect to the database by telling it the location of the database and the name of the database.

In our app.js file after the line for the port and before the app.use line, enter the following two lines to get access to mongoose and to connect to the database. For the database, I am going to use “node-demo”.

var mongoose = require("mongoose"); mongoose.Promise = global.Promise; mongoose.connect("mongodb://localhost:27017/node-demo");

Creating a Database Schema

Once the user enters data in the input field and clicks the add button, we want the contents of the input field to be stored in the database. In order to know the format of the data in the database, we need to have a Schema.

For this tutorial, we will need a very simple Schema that has only two fields. I am going to call the field firstName and lastName. The data stored in both fields will be a String.

After connecting to the database in our app.js we need to define our Schema. Here are the lines you need to add to the app.js.
var nameSchema = new mongoose.Schema({   firstName: String,   lastNameName: String });

Once we have built our Schema, we need to create a model from it. I am going to call my model “DataInput”. Here is the line you will add next to create our mode.
var User = mongoose.model("User", nameSchema);

Creating RESTful API

Now that we have a connection to our database, we need to create the mechanism by which data will be added to the database. This is done through our REST API. We will need to create an endpoint that will be used to send data to our server. Once the server receives this data then it will store the data in the database.

An endpoint is a route that our server will be listening to to get data from the browser. We already have one route that we have created already in the application and that is the route that is listening at the endpoint “/” which is the homepage of our application.

HTTP Verbs in a REST API

The communication between the client(the browser) and the server is done through an HTTP verb. The most common HTTP verbs are
GET, PUT, POST, and DELETE.

The following table explains what each HTTP verb does.

HTTP Verb Operation
GET Read
POST Create
PUT Update
DELETE Delete

As you can see from these verbs, they form the basis of CRUD operations that I talked about previously.

Building a CRUD endpoint

If you remember, the form in our index.html file used a post method to call this endpoint. We will now create this endpoint.

In our previous endpoint we used a “GET” http verb to display the index.html file. We are going to do something very similar but instead of using “GET”, we are going to use “POST”. To get started this is what the framework of our endpoint will look like.

app.post("/addname", (req, res) => {
 
});
Express Middleware

To fill out the contents of our endpoint, we want to store the firstName and lastName entered by the user into the database. The values for firstName and lastName are in the body of the request that we send to the server. We want to capture that data, convert it to JSON and store it into the database.

Express.js version 4 removed all middleware. To parse the data in the body we will need to add middleware into our application to provide this functionality. We will be using the body-parser module. We need to install it, so in your terminal window enter the following command.

npm install body-parser --save

Once it is installed, we will need to require this module and configure it. The configuration will allow us to pass the data for firstName and lastName in the body to the server. It can also convert that data into JSON format. This will be handy because we can take this formatted data and save it directly into our database.

To add the body-parser middleware to our application and configure it, we can add the following lines directly after the line that sets our port.

var bodyParser = require('body-parser');
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({ extended: true }));
Saving data to database

Mongoose provides a save function that will take a JSON object and store it in the database. Our body-parser middleware, will convert the user’s input into the JSON format for us.

To save the data into the database, we need to create a new instance of our model that we created early. We will pass into this instance the user’s input. Once we have it then we just need to enter the command “save”.

Mongoose will return a promise on a save to the database. A promise is what is returned when the save to the database completes. This save will either finish successfully or it will fail. A promise provides two methods that will handle both of these scenarios.

If this save to the database was successful it will return to the .then segment of the promise. In this case we want to send text back the user to let them know the data was saved to the database.

If it fails it will return to the .catch segment of the promise. In this case, we want to send text back to the user telling them the data was not saved to the database. It is best practice to also change the statusCode that is returned from the default 200 to a 400. A 400 statusCode signifies that the operation failed.

Now putting all of this together here is what our final endpoint will look like.

app.post("/addname", (req, res) => {
  var myData = new User(req.body);
  myData.save()
    .then(item => {
      res.send("item saved to database");
    })
    .catch(err => {
      res.status(400).send("unable to save to database");
    });
});
Testing our code

Save your code. Go to your terminal and enter the command node app.js to start our server. Open up your browser and navigate to the URL “http://localhost:3000”. You will see our index.html file displayed to you.

Make sure you have mongo running.

Enter your first name and last name in the input fields and then click the “Add Name” button. You should get back text that says the name has been saved to the database like below.

Access to Code

The final version of the code is available in my Github repo. To access the code click here. Thank you for reading !

Node.js for Beginners - Learn Node.js from Scratch (Step by Step)

Node.js for Beginners - Learn Node.js from Scratch (Step by Step)

Node.js for Beginners - Learn Node.js from Scratch (Step by Step) - Learn the basics of Node.js. This Node.js tutorial will guide you step by step so that you will learn basics and theory of every part. Learn to use Node.js like a professional. You’ll learn: Basic Of Node, Modules, NPM In Node, Event, Email, Uploading File, Advance Of Node.

Node.js for Beginners

Learn Node.js from Scratch (Step by Step)

Welcome to my course "Node.js for Beginners - Learn Node.js from Scratch". This course will guide you step by step so that you will learn basics and theory of every part. This course contain hands on example so that you can understand coding in Node.js better. If you have no previous knowledge or experience in Node.js, you will like that the course begins with Node.js basics. otherwise if you have few experience in programming in Node.js, this course can help you learn some new information . This course contain hands on practical examples without neglecting theory and basics. Learn to use Node.js like a professional. This comprehensive course will allow to work on the real world as an expert!
What you’ll learn:

  • Basic Of Node
  • Modules
  • NPM In Node
  • Event
  • Email
  • Uploading File
  • Advance Of Node

Top 7 Most Popular Node.js Frameworks You Should Know

Top 7 Most Popular Node.js Frameworks You Should Know

Node.js is an open-source, cross-platform, runtime environment that allows developers to run JavaScript outside of a browser. In this post, you'll see top 7 of the most popular Node frameworks at this point in time (ranked from high to low by GitHub stars).

Node.js is an open-source, cross-platform, runtime environment that allows developers to run JavaScript outside of a browser.

One of the main advantages of Node is that it enables developers to use JavaScript on both the front-end and the back-end of an application. This not only makes the source code of any app cleaner and more consistent, but it significantly speeds up app development too, as developers only need to use one language.

Node is fast, scalable, and easy to get started with. Its default package manager is npm, which means it also sports the largest ecosystem of open-source libraries. Node is used by companies such as NASA, Uber, Netflix, and Walmart.

But Node doesn't come alone. It comes with a plethora of frameworks. A Node framework can be pictured as the external scaffolding that you can build your app in. These frameworks are built on top of Node and extend the technology's functionality, mostly by making apps easier to prototype and develop, while also making them faster and more scalable.

Below are 7of the most popular Node frameworks at this point in time (ranked from high to low by GitHub stars).

Express

With over 43,000 GitHub stars, Express is the most popular Node framework. It brands itself as a fast, unopinionated, and minimalist framework. Express acts as middleware: it helps set up and configure routes to send and receive requests between the front-end and the database of an app.

Express provides lightweight, powerful tools for HTTP servers. It's a great framework for single-page apps, websites, hybrids, or public HTTP APIs. It supports over fourteen different template engines, so developers aren't forced into any specific ORM.

Meteor

Meteor is a full-stack JavaScript platform. It allows developers to build real-time web apps, i.e. apps where code changes are pushed to all browsers and devices in real-time. Additionally, servers send data over the wire, instead of HTML. The client renders the data.

The project has over 41,000 GitHub stars and is built to power large projects. Meteor is used by companies such as Mazda, Honeywell, Qualcomm, and IKEA. It has excellent documentation and a strong community behind it.

Koa

Koa is built by the same team that built Express. It uses ES6 methods that allow developers to work without callbacks. Developers also have more control over error-handling. Koa has no middleware within its core, which means that developers have more control over configuration, but which means that traditional Node middleware (e.g. req, res, next) won't work with Koa.

Koa already has over 26,000 GitHub stars. The Express developers built Koa because they wanted a lighter framework that was more expressive and more robust than Express. You can find out more about the differences between Koa and Express here.

Sails

Sails is a real-time, MVC framework for Node that's built on Express. It supports auto-generated REST APIs and comes with an easy WebSocket integration.

The project has over 20,000 stars on GitHub and is compatible with almost all databases (MySQL, MongoDB, PostgreSQL, Redis). It's also compatible with most front-end technologies (Angular, iOS, Android, React, and even Windows Phone).

Nest

Nest has over 15,000 GitHub stars. It uses progressive JavaScript and is built with TypeScript, which means it comes with strong typing. It combines elements of object-oriented programming, functional programming, and functional reactive programming.

Nest is packaged in such a way it serves as a complete development kit for writing enterprise-level apps. The framework uses Express, but is compatible with a wide range of other libraries.

LoopBack

LoopBack is a framework that allows developers to quickly create REST APIs. It has an easy-to-use CLI wizard and allows developers to create models either on their schema or dynamically. It also has a built-in API explorer.

LoopBack has over 12,000 GitHub stars and is used by companies such as GoDaddy, Symantec, and the Bank of America. It's compatible with many REST services and a wide variety of databases (MongoDB, Oracle, MySQL, PostgreSQL).

Hapi

Similar to Express, hapi serves data by intermediating between server-side and client-side. As such, it's can serve as a substitute for Express. Hapi allows developers to focus on writing reusable app logic in a modular and prescriptive fashion.

The project has over 11,000 GitHub stars. It has built-in support for input validation, caching, authentication, and more. Hapi was originally developed to handle all of Walmart's mobile traffic during Black Friday.