Input and resource controls
Validate every request shape
Parse parameters, headers, bodies, and content types into bounded application values before business logic uses them.
8 minute lesson
JSON syntax only proves the body is JSON. It says nothing about the values your operation can safely accept.
Validate types, lengths, ranges, formats, nesting depth, array size, and allowed fields. Reject unsupported content types and ambiguous duplicates. Apply validation again when a message arrives from a queue or third party.
A valid JSON body can contain 50,000 line items or a negative total. Rejecting unknown fields is safer for authority-bearing input, but tolerant readers may be useful for harmless provider additions.
Validate after decoding but before costly business work begins. Also verify the queue consumer, because an internal producer or old message may bypass the current HTTP schema entirely.
Record the accepted invoice schema and its numeric, size, and nesting limits. Test the exact boundaries plus one value beyond each limit, and prove rejected input creates no invoice.
Lesson completed