Validating API Requests with Zod in Express.js

Validating API requests with Zod in Express.js is essential for building secure, reliable backends. This guide walks you through implementing type-safe validation to prevent malicious inputs and ensure data integrity.

Validating API Requests with Zod in Express.js

Unvalidated API endpoints are a top security risk, exposing systems to injection attacks and data corruption. Zod provides a type-safe schema validation solution that integrates seamlessly with Express.js, catching invalid data before it reaches your business logic.

Why API Validation Matters for Security

Without proper validation, attackers can exploit APIs through malformed payloads. Common threats include SQL injection, XSS attacks, and server crashes from unexpected data types. Zod eliminates these risks by enforcing strict input rules while providing clear error messages for developers and clients.

Setting Up Zod with Express.js

Install the required dependencies:

1. zod for schema validation
2. express as your server framework
3. @types/express for TypeScript support (if using TS)

Create a schema for your expected request structure. For example:

import { z } from 'zod';

const userSchema = z.object({
  name: z.string().min(3),
  email: z.string().email(),
  age: z.number().min(18)
});

Creating a Validation Middleware

Build reusable middleware to handle validation:

const validate = (schema) => (req, res, next) => {
  try {
    schema.parse(req.body);
    next();
  } catch (err) {
    res.status(400).json({ error: err.errors });
  }
};

Handling Validation Errors Gracefully

Customize error responses for better UX:

• Use Zod’s formatError to map errors to user-friendly messages
• Log errors server-side for debugging without exposing details
• Return standardized error objects with codes for client-side handling

TypeScript Integration Benefits

Zod shines when paired with TypeScript. The schema automatically infers types, reducing manual type definitions:

type User = z.infer;
// User type is { name: string; email: string; age: number }

Practical Example: User Registration

Here’s a complete example validating a user registration request:

const registerSchema = z.object({
  username: z.string().min(4),
  password: z.string().min(8),
  email: z.string().email()
});

app.post('/register', validate(registerSchema), (req, res) => {
  // Save user to database
  res.status(201).json({ message: 'User created' });
});

Conclusion

Implementing Zod validation in Express.js ensures your API handles only valid data, reducing security risks and improving reliability. By combining type-safe schemas with expressive error handling, you build robust backends that scale securely. Start integrating Zod today to protect your application from malformed requests.