The non-negotiable step.
WHAT TO VALIDATE
Every value arriving from outside.
WHAT COUNTS AS OUTSIDE
Request bodies Query parameters Path segments Headers Uploaded files Responses from other services
THAT LAST ONE
External services change, and their responses are not guaranteed.
WHAT TO CHECK
Presence Type Format Range and length Whether the value is permitted in context
WHAT TO PREFER
A schema definition, validated in one place, rather than checks scattered through handlers.
WHY
It is consistent, documented and testable.
WHAT TO DO WITH INVALID INPUT
Reject it, with a clear message naming the field.
WHAT NOT TO DO
Attempt to correct it silently Accept it and handle the consequences later
WHAT TO NEVER TRUST
Identifiers in a request indicating ownership Prices, totals or quantities from the client Hidden fields Anything the client could have altered
WHAT TO ENFORCE SEPARATELY
Limits: request size, upload size, array lengths.
WHY
Absent limits are how services are overwhelmed.
