Smart Node.js Form Validation

Smart Node.js Form Validation

Bulletproof Node.js form validation is fundamental to implementing a back-end API, and the datalize JavaScript validation library makes it easy.

Bulletproof Node.js form validation is fundamental to implementing a back-end API, and the datalize JavaScript validation library makes it easy.

One of the fundamental tasks to perform in an API is data validation. In this article, I’d like to show you how to add bulletproof validation for your data in a way that also returns it nicely formatted.

Doing custom data validation in Node.js is neither easy nor quick. There’s a lot of functionality you need to write in order to cover any kind of data. While I’ve tried a few Node.js form data libraries—for both Express and Koa—they’ve never fulfilled the needs of my projects. There were problems with extending libraries and the libraries not working with complex data structures or asynchronous validation.

Form Validation in Node.js with Datalize

That’s why I eventually decided to write my own tiny-but-powerful form validation library called datalize. It’s extendable, so you can use it in any project and customize it to your requirements. It validates a request’s body, query, or params. It also supports async filters and complex JSON structures like arrays or nested objects.

Setup

Datalize can be installed via npm:

npm install --save datalize


To parse a request’s body, you should use a separate library. If you don’t already use one, I recommend koa-body for Koa or body-parser for Express.

You can apply this tutorial to your already-set-up HTTP API server, or use the following simple Koa HTTP server code.

const Koa = require('koa');
const bodyParser = require('koa-body');

const app = new Koa();
const router = new (require('koa-router'))();

// helper for returning errors in routes
app.context.error = function(code, obj) {
this.status = code;
this.body = obj;
};

// add koa-body middleware to parse JSON and form-data body
app.use(bodyParser({
enableTypes: ['json', 'form'],
multipart: true,
formidable: {
maxFileSize: 32 * 1024 * 1024,
}
}));

// Routes...

// connect defined routes as middleware to Koa
app.use(router.routes());
// our app will listen on port 3000
app.listen(3000);

console.log('🌍 API listening on 3000');


However, this is not a production setup (you should use logging, enforce authorization, handle errors, etc.), but these few lines of code will work just fine for the examples I’ll show you.

Note: All code examples use Koa, but the data validation code will work for Express as well. The datalize library also has an example for implementing Express form validation.

A Basic Node.js Form Validation Example

Let’s say you have a Koa or Express web server and an endpoint in your API that creates a user with several fields in the database. Some fields are required, and some can only have specific values or must be formatted to correct type.

You could write simple logic like this:

/**
 * @api {post} / Create a user
 * ...
 */
router.post('/', (ctx) => {
	const data = ctx.request.body;
	const errors = {};

	if (!String(data.name).trim()) {
		errors.name = ['Name is required'];
	}

	if (!(/^[\-0-9a-zA-Z\.\+_][email protected][\-0-9a-zA-Z\.\+_]+\.[a-zA-Z]{2,}$/).test(String(data.email))) {
		errors.email = ['Email is not valid.'];
	}

	if (Object.keys(errors).length) {
		return ctx.error(400, {errors});
	}

	const user = await User.create({
			name: data.name,
			email: data.email,
	});

	ctx.body = user.toJSON();
});


Now let’s rewrite this code and validate this request using datalize:

const datalize = require('datalize');
const field = datalize.field;

/**
 * @api {post} / Create a user
 * ...
 */
router.post('/', datalize([
	field('name').trim().required(),
	field('email').required().email(),
]), (ctx) => {
	if (!ctx.form.isValid) {
		return ctx.error(400, {errors: ctx.form.errors});
	}

	const user = await User.create(ctx.form);

	ctx.body = user.toJSON();
});


Shorter, cleaner, so easy to read. With datalize, you can specify a list of fields and chain to them as many rules (functions that throw an error if the input is invalid) or filters (functions that format the input) as you want.

The rules and filters are executed in the same order as they’re defined, so if you want to trim a string for whitespace first and then check if it has any value, you have to define .trim() before .required().

Datalize will then create an object (available as .form in the wider context object) with just the fields you have specified, so you don’t have to list them again. The .form.isValid property tells you whether validation was successful or not.

Automatic Error Handling

If we don’t want to check whether the form is valid or not with every request, we can add a global middleware which cancels the request if the data didn’t pass validation.

To do this we just add this piece of code to our bootstrap file where we create our Koa/Express app instance.

const datalize = require('datalize');

// set datalize to throw an error if validation fails
datalize.set('autoValidate', true);

// only Koa
// add to very beginning of Koa middleware chain
app.use(async (ctx, next) => {
	try {
		await next();
	} catch (err) {
		if (err instanceof datalize.Error) {
			ctx.status = 400;
			ctx.body = err.toJSON();
		} else {
			ctx.status = 500;
			ctx.body = 'Internal server error';
		}
	}
});

// only Express
// add to very end of Express middleware chain
app.use(function(err, req, res, next) {
	if (err instanceof datalize.Error) {
		res.status(400).send(err.toJSON());
	} else {
		res.send(500).send('Internal server error');
	}
});


And we don’t have to check if data is valid anymore, as datalize will do it for us. If the data is invalid, it will return a formatted error message with a list of invalid fields.

Query Validation

Yes, you can even validate your query parameters very easily—it doesn’t have to be used with POST requests only. We just use the .query() helper method, and the only difference is that the data is stored in the .data object instead of .form.

const datalize = require('datalize');
const field = datalize.field;

/**
 * @api {get} / List users
 * ...
 */
router.post('/', datalize.query([
	field('keywords').trim(),
	field('page').default(1).number(),
	field('perPage').required().select([10, 30, 50]),
]), (ctx) => {
	const limit = ctx.data.perPage;
	const where = {
	};

	if (ctx.data.keywords) {
		where.name = {[Op.like]: ctx.data.keywords + '%'};
	}

	const users = await User.findAll({
		where,
		limit,
		offset: (ctx.data.page - 1) * limit,
	});

	ctx.body = users;
});


There is also a helper method for parameter validation, .params(). Query and form data can be validated together by passing two datalize middlewares in the router’s .post() method.

More Filters, Arrays, and Nested Objects

So far we’ve used really simple data in our Node.js form validation. Now let’s try some more complex fields like arrays, nested objects, etc.:

const datalize = require('datalize');
const field = datalize.field;
const DOMAIN_ERROR = "Email's domain does not have a valid MX (mail) entry in its DNS record";

/**
 * @api {post} / Create a user
 * ...
 */
router.post('/', datalize([
	field('name').trim().required(),
	field('email').required().email().custom((value) => {
		return new Promise((resolve, reject) => {
			dns.resolve(value.split('@')[1], 'MX', function(err, addresses) {
				if (err || !addresses || !addresses.length) {
					return reject(new Error(DOMAIN_ERROR));
				}

				resolve();
			});
		});
	}),
	field('type').required().select(['admin', 'user']),
	field('languages').array().container([
		field('id').required().id(),
		field('level').required().select(['beginner', 'intermediate', 'advanced'])
	]),
	field('groups').array().id(),
]), async (ctx) => {
	const {languages, groups} = ctx.form;
	delete ctx.form.languages;
	delete ctx.form.groups;

	const user = await User.create(ctx.form);

	await UserGroup.bulkCreate(groups.map(groupId => ({
		groupId,
		userId: user.id,
	})));

	await UserLanguage.bulkCreate(languages.map(item => ({
		languageId: item.id,
		userId: user.id,
		level: item.level,
	));
});


If there is no built-in rule for data we need to validate, we can create a custom data validation rule with the .custom() method (great name, right?) and write the necessary logic there. For nested objects, there is the .container() method in which you can specify a list of fields the same way as in the datalize() function. You can nest containers within containers or supplement them with .array() filters, which converts values to arrays. When the .array() filter is used without a container, the specified rules or filters are applied to every value in the array.

So .array().select(['read', 'write']) would check if every value in the array is either 'read' or 'write' and if any are not, it will return a list of all indexes with errors. Pretty cool, huh?

PUT/PATCH

When it comes to updating your data with PUT/PATCH (or POST), you don’t have to rewrite all your logic, rules, and filters. You just add an extra filter like .optional() or .patch(), which will remove any field from the context object if it was not defined in the request. (.optional() will make it always optional, whereas .patch() will make it optional only if the HTTP request’s method is PATCH.) You can add this extra filter so it works for both creating and updating data in your database.

const datalize = require('datalize');
const field = datalize.field;

const userValidator = datalize([
	field('name').patch().trim().required(),
	field('email').patch().required().email(),
	field('type').patch().required().select(['admin', 'user']),
]);

const userEditMiddleware = async (ctx, next) => {
	const user = await User.findByPk(ctx.params.id);

	// cancel request here if user was not found
	if (!user) {
		throw new Error('User was not found.');
	}

	// store user instance in the request so we can use it later
	ctx.user = user;

	return next();
};

/**
 * @api {post} / Create a user
 * ...
 */
router.post('/', userValidator, async (ctx) => {
	const user = await User.create(ctx.form);

	ctx.body = user.toJSON();
});

/**
 * @api {put} / Update a user
 * ...
 */
router.put('/:id', userEditMiddleware, userValidator, async (ctx) => {
	await ctx.user.update(ctx.form);

	ctx.body = ctx.user.toJSON();
});

/**
 * @api {patch} / Patch a user
 * ...
 */
router.patch('/:id', userEditMiddleware, userValidator, async (ctx) => {
	if (!Object.keys(ctx.form).length) {
		return ctx.error(400, {message: 'Nothing to update.'});
	}

	await ctx.user.update(ctx.form);

	ctx.body = ctx.user.toJSON();
});


With two simple middlewares, we can write most logic for all POST/PUT/PATCH methods. The userEditMiddleware() function verifies if the record that we want to edit exists and throws an error otherwise. Then userValidator() does the validation for all endpoints. Finally, the .patch() filter will remove any field from the .form object if it’s not defined and if the request’s method is PATCH.

Node.js Form Validation Extras

In custom filters, you can get values of other fields and perform validation based on that. You can also get any data from the context object, like request or user information, as it’s all provided in custom function callback parameters.

The library covers a basic set of rules and filters, but you can register custom global filters that you can use with any fields, so you don’t have to write the same code over and over:

const datalize = require('datalize');
const Field = datalize.Field;

Field.prototype.date = function(format = 'YYYY-MM-DD') {
  return this.add(function(value) {
    const date = value ? moment(value, format) : null;

    if (!date || !date.isValid()) {
      throw new Error('%s is not a valid date.');
    }

    return date.format(format);
  });
};

Field.prototype.dateTime = function(format = 'YYYY-MM-DD HH:mm') {
  return this.date(format);
};


With these two custom filters you can chain your fields with .date() or .dateTime() filters to validate date input.

Files can also be validated using datalize: There are special filters just for files like .file(), .mime(), and .size() so you don’t have to handle files separately.

Start Writing Better APIs Now

I’ve been using datalize for Node.js form validation in several production projects already, for both small and large APIs. It’s helped me to deliver great projects on time and with less stress while making them more readable and maintainable. On one project I’ve even used it to validate data for WebSocket messages by writing a simple wrapper around Socket.IO and the usage was pretty much the same as defining routes in Koa, so that was nice. If there is enough interest, I might write a tutorial for that as well.

I hope this tutorial will help you and I build better APIs in Node.js, with perfectly validated data without security issues or internal server errors. And most importantly, I hope it will save you a ton of time that you would otherwise have to invest in writing extra functions for form validation using JavaScript.

Top 7 Most Popular Node.js Frameworks You Should Know

Top 7 Most Popular Node.js Frameworks You Should Know

Node.js is an open-source, cross-platform, runtime environment that allows developers to run JavaScript outside of a browser. In this post, you'll see top 7 of the most popular Node frameworks at this point in time (ranked from high to low by GitHub stars).

Node.js is an open-source, cross-platform, runtime environment that allows developers to run JavaScript outside of a browser.

One of the main advantages of Node is that it enables developers to use JavaScript on both the front-end and the back-end of an application. This not only makes the source code of any app cleaner and more consistent, but it significantly speeds up app development too, as developers only need to use one language.

Node is fast, scalable, and easy to get started with. Its default package manager is npm, which means it also sports the largest ecosystem of open-source libraries. Node is used by companies such as NASA, Uber, Netflix, and Walmart.

But Node doesn't come alone. It comes with a plethora of frameworks. A Node framework can be pictured as the external scaffolding that you can build your app in. These frameworks are built on top of Node and extend the technology's functionality, mostly by making apps easier to prototype and develop, while also making them faster and more scalable.

Below are 7of the most popular Node frameworks at this point in time (ranked from high to low by GitHub stars).

Express

With over 43,000 GitHub stars, Express is the most popular Node framework. It brands itself as a fast, unopinionated, and minimalist framework. Express acts as middleware: it helps set up and configure routes to send and receive requests between the front-end and the database of an app.

Express provides lightweight, powerful tools for HTTP servers. It's a great framework for single-page apps, websites, hybrids, or public HTTP APIs. It supports over fourteen different template engines, so developers aren't forced into any specific ORM.

Meteor

Meteor is a full-stack JavaScript platform. It allows developers to build real-time web apps, i.e. apps where code changes are pushed to all browsers and devices in real-time. Additionally, servers send data over the wire, instead of HTML. The client renders the data.

The project has over 41,000 GitHub stars and is built to power large projects. Meteor is used by companies such as Mazda, Honeywell, Qualcomm, and IKEA. It has excellent documentation and a strong community behind it.

Koa

Koa is built by the same team that built Express. It uses ES6 methods that allow developers to work without callbacks. Developers also have more control over error-handling. Koa has no middleware within its core, which means that developers have more control over configuration, but which means that traditional Node middleware (e.g. req, res, next) won't work with Koa.

Koa already has over 26,000 GitHub stars. The Express developers built Koa because they wanted a lighter framework that was more expressive and more robust than Express. You can find out more about the differences between Koa and Express here.

Sails

Sails is a real-time, MVC framework for Node that's built on Express. It supports auto-generated REST APIs and comes with an easy WebSocket integration.

The project has over 20,000 stars on GitHub and is compatible with almost all databases (MySQL, MongoDB, PostgreSQL, Redis). It's also compatible with most front-end technologies (Angular, iOS, Android, React, and even Windows Phone).

Nest

Nest has over 15,000 GitHub stars. It uses progressive JavaScript and is built with TypeScript, which means it comes with strong typing. It combines elements of object-oriented programming, functional programming, and functional reactive programming.

Nest is packaged in such a way it serves as a complete development kit for writing enterprise-level apps. The framework uses Express, but is compatible with a wide range of other libraries.

LoopBack

LoopBack is a framework that allows developers to quickly create REST APIs. It has an easy-to-use CLI wizard and allows developers to create models either on their schema or dynamically. It also has a built-in API explorer.

LoopBack has over 12,000 GitHub stars and is used by companies such as GoDaddy, Symantec, and the Bank of America. It's compatible with many REST services and a wide variety of databases (MongoDB, Oracle, MySQL, PostgreSQL).

Hapi

Similar to Express, hapi serves data by intermediating between server-side and client-side. As such, it's can serve as a substitute for Express. Hapi allows developers to focus on writing reusable app logic in a modular and prescriptive fashion.

The project has over 11,000 GitHub stars. It has built-in support for input validation, caching, authentication, and more. Hapi was originally developed to handle all of Walmart's mobile traffic during Black Friday.

Difference between AngularJS, React, Ember, Backbone, and Node.js.

The most common thing between all of them is that they are Single Page Apps. The SPA is a single page where much of the information remains the same and only some piece of data gets modified when you click on other categories/option.

Node.js Tutorial for Beginners | Node.js Crash Course | Node.js Certification Training

This courseis designed for professionals who aspire to be application developers and gain expertise in building real-time, highly-scalable applications in Node.js. The following professionals can go for this course :

Why learn Node.js?

Node.js uses JavaScript - a language known to millions of developers worldwide - thus giving it a much lower learning curve even for complete beginners. Using Node.js you can build simple Command Line programs or complex enterprise level web applications with equal ease. Node.js is an event-driven, server-side, asynchronous development platform with lightning speed execution. Node.js helps you to code the most complex functionalities in just a few lines of code...

Thanks for reading :heart: If you liked this post, share it with all of your programming buddies! Follow me on Facebook | Twitter

Learn More

The Complete Node.js Developer Course (3rd Edition)

Angular & NodeJS - The MEAN Stack Guide

NodeJS - The Complete Guide (incl. MVC, REST APIs, GraphQL)

Docker for Node.js Projects From a Docker Captain

Intro To MySQL With Node.js - Learn To Use MySQL with Node!

Node.js Absolute Beginners Guide - Learn Node From Scratch

React Node FullStack - Social Network from Scratch to Deploy

Selenium WebDriver - JavaScript nodeJS webdriver IO & more!

Complete Next.js with React & Node - Beautiful Portfolio App

Build a Blockchain & Cryptocurrency | Full-Stack Edition