Input validation security

Security validation assumes hostile input — every byte from clients, webhooks, queues, and admin panels may be malicious. Shape validation alone does not stop injection or logic abuse.

Check beyond types:

• Size limits (body, headers, file upload, array length)
• Encoding normalization (Unicode homoglyphs, overlong UTF-8)
• Allowlists over blocklists for enums and file types
• Parameterized queries — never string-concat SQL
• Path traversal on file names (`../../etc/passwd`)
• SSRF when fetching user-supplied URLs
• Prototype pollution keys (`__proto__`, `constructor`)

					const Filename = z.string().max(128).regex(/^[a-zA-Z0-9._-]+$/);
const safePath = path.join(uploadDir, path.basename(parsed.data.name));
				

Validate in context of authenticated identity — user A's ID in path must match session unless admin role.

On interviews: difference from business validation; example combining schema + authorization; OWASP-aligned limits.

Common pitfalls: regex alone for email/HTML; trusting internal network callers without validation; mass assignment binding `req.body` directly to ORM model.

The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.

Checklist:

• Limits at reverse proxy and app.
• Allowlist enums and MIME types.
• Sanitize output encoding for context (HTML, URL).
• Security tests for boundary payloads.