HTML MASTER CLASS /// LEARN TAGS /// BUILD STRUCTURE /// SEMANTIC WEB /// HTML MASTER CLASS /// LEARN TAGS ///

Untitled Lesson

⚡ Total XP: 0|💻 backend XP: 0

Skill Matrix

UNLOCK NODES BY LEARNING NEW TAGS.

Select an unlocked node to view details root

Pascual Vila

Frontend Instructor // Code Syllabus

Common Pitfalls & Errors

The Error //

Defining a validation schema but forgetting to enable stripUnknown, leaving mass-assignment attacks open

// Wrong: role: 'admin' passes straight through untouched
const { error, value } = schema.validate(req.body);
await UserModel.create(req.body); // still has the raw, unstripped body!

// Correct: only validated, known fields survive
const { error, value } = schema.validate(req.body, { stripUnknown: true });
await UserModel.create(value);

The Solution //

A schema that only checks the fields it knows about (email, password) but passes the entire req.body through to the database still lets an attacker slip in extra fields like role: 'admin' that were never validated but also never stripped out. Explicitly enable stripUnknown (Joi) or use .strict()/.pick() equivalents so any field not declared in the schema is deleted before the data reaches your Service or Model layer.

The Error //

Returning the raw validation library error object directly to the client

// Wrong: leaks internal library structure to the client
res.status(400).json(error);

// Correct: stable, minimal shape
res.status(400).json({
  status: 'fail',
  errors: error.details.map(d => ({ field: d.path.join('.'), message: d.message }))
});

The Solution //

Joi/Zod's native error objects are deeply nested and inconsistent in shape, are not designed for public consumption, and can leak internal schema details. Map validation failures into a stable, minimal { field, message } array before sending a 400 response, so the frontend has a predictable contract regardless of which validation library is used underneath.