Validate JavaScript inputs at the boundary

The decision

An HTML input helps a person enter data, but it does not define what your server can trust. A request can bypass the browser entirely. Start by listing the values the operation accepts, the values it rejects, and what a caller should see when the request is invalid. Keep parsing separate from side effects so malformed requests cannot send email, charge money, or write partial records.

A worked example

A task list accepts a title between 1 and 120 characters. The browser limits the field, but the server still receives an unknown value. A title made only of spaces should fail after trimming; a number should fail without being coerced into a title. The parsed object has exactly one field. Additional fields such as ownerId are ignored and the authenticated owner is resolved on the server.

How to put it into practice

1. Check the type before calling string methods. Treat null, arrays, and objects as different inputs.
2. Normalize only what the contract permits. Trimming a title is reasonable; silently lowercasing a password is not.
3. Validate size before expensive work. A tiny UI field does not stop a multi-megabyte direct request.
4. Return a specific public error without echoing private request bodies into logs.

function parseTitle(value) {
  if (typeof value !== "string") return null;
  const title = value.trim();
  return title.length > 0 && title.length <= 120
    ? { title } : null;
}

A failure to plan for

Try it on your project

Write a table of eight inputs: missing, null, number, empty string, spaces, valid title, exactly 120 characters, and 121 characters. Run each through the parser. Confirm that none of the rejected inputs starts a database write.

Primary reference

Read the official documentation →