Node js validation error

Node.js JavaScript runtime :sparkles::turtle::rocket::sparkles: - node/errors.md at main · nodejs/node

Applications running in Node.js will generally experience four categories of
errors:

  • Standard JavaScript errors such as {EvalError}, {SyntaxError}, {RangeError},
    {ReferenceError}, {TypeError}, and {URIError}.
  • System errors triggered by underlying operating system constraints such
    as attempting to open a file that does not exist or attempting to send data
    over a closed socket.
  • User-specified errors triggered by application code.
  • AssertionErrors are a special class of error that can be triggered when
    Node.js detects an exceptional logic violation that should never occur. These
    are raised typically by the node:assert module.

All JavaScript and system errors raised by Node.js inherit from, or are
instances of, the standard JavaScript {Error} class and are guaranteed
to provide at least the properties available on that class.

Error propagation and interception

Node.js supports several mechanisms for propagating and handling errors that
occur while an application is running. How these errors are reported and
handled depends entirely on the type of Error and the style of the API that is
called.

All JavaScript errors are handled as exceptions that immediately generate
and throw an error using the standard JavaScript throw mechanism. These
are handled using the try…catch construct provided by the
JavaScript language.

// Throws with a ReferenceError because z is not defined.
try {
  const m = 1;
  const n = m + z;
} catch (err) {
  // Handle the error here.
}

Any use of the JavaScript throw mechanism will raise an exception that
must be handled using try…catch or the Node.js process will exit
immediately.

With few exceptions, Synchronous APIs (any blocking method that does not
accept a callback function, such as fs.readFileSync), will use throw
to report errors.

Errors that occur within Asynchronous APIs may be reported in multiple ways:

  • Most asynchronous methods that accept a callback function will accept an
    Error object passed as the first argument to that function. If that first
    argument is not null and is an instance of Error, then an error occurred
    that should be handled.

    const fs = require('node:fs');
    fs.readFile('a file that does not exist', (err, data) => {
      if (err) {
        console.error('There was an error reading the file!', err);
        return;
      }
      // Otherwise handle the data
    });
  • When an asynchronous method is called on an object that is an
    EventEmitter, errors can be routed to that object’s 'error' event.

    const net = require('node:net');
    const connection = net.connect('localhost');
    
    // Adding an 'error' event handler to a stream:
    connection.on('error', (err) => {
      // If the connection is reset by the server, or if it can't
      // connect at all, or on any sort of error encountered by
      // the connection, the error will be sent here.
      console.error(err);
    });
    
    connection.pipe(process.stdout);
  • A handful of typically asynchronous methods in the Node.js API may still
    use the throw mechanism to raise exceptions that must be handled using
    try…catch. There is no comprehensive list of such methods; please
    refer to the documentation of each method to determine the appropriate
    error handling mechanism required.

The use of the 'error' event mechanism is most common for stream-based
and event emitter-based APIs, which themselves represent a series of
asynchronous operations over time (as opposed to a single operation that may
pass or fail).

For all EventEmitter objects, if an 'error' event handler is not
provided, the error will be thrown, causing the Node.js process to report an
uncaught exception and crash unless either: The domain module is
used appropriately or a handler has been registered for the
'uncaughtException' event.

const EventEmitter = require('node:events');
const ee = new EventEmitter();

setImmediate(() => {
  // This will crash the process because no 'error' event
  // handler has been added.
  ee.emit('error', new Error('This will crash'));
});

Errors generated in this way cannot be intercepted using try…catch as
they are thrown after the calling code has already exited.

Developers must refer to the documentation for each method to determine
exactly how errors raised by those methods are propagated.

Error-first callbacks

Most asynchronous methods exposed by the Node.js core API follow an idiomatic
pattern referred to as an error-first callback. With this pattern, a callback
function is passed to the method as an argument. When the operation either
completes or an error is raised, the callback function is called with the
Error object (if any) passed as the first argument. If no error was raised,
the first argument will be passed as null.

const fs = require('node:fs');

function errorFirstCallback(err, data) {
  if (err) {
    console.error('There was an error', err);
    return;
  }
  console.log(data);
}

fs.readFile('/some/file/that/does-not-exist', errorFirstCallback);
fs.readFile('/some/file/that/does-exist', errorFirstCallback);

The JavaScript try…catch mechanism cannot be used to intercept errors
generated by asynchronous APIs. A common mistake for beginners is to try to
use throw inside an error-first callback:

// THIS WILL NOT WORK:
const fs = require('node:fs');

try {
  fs.readFile('/some/file/that/does-not-exist', (err, data) => {
    // Mistaken assumption: throwing here...
    if (err) {
      throw err;
    }
  });
} catch (err) {
  // This will not catch the throw!
  console.error(err);
}

This will not work because the callback function passed to fs.readFile() is
called asynchronously. By the time the callback has been called, the
surrounding code, including the try…catch block, will have already exited.
Throwing an error inside the callback can crash the Node.js process in most
cases. If domains are enabled, or a handler has been registered with
process.on('uncaughtException'), such errors can be intercepted.

Class: Error

A generic JavaScript {Error} object that does not denote any specific
circumstance of why the error occurred. Error objects capture a «stack trace»
detailing the point in the code at which the Error was instantiated, and may
provide a text description of the error.

All errors generated by Node.js, including all system and JavaScript errors,
will either be instances of, or inherit from, the Error class.

new Error(message[, options])

  • message {string}
  • options {Object}
    • cause {any} The error that caused the newly created error.

Creates a new Error object and sets the error.message property to the
provided text message. If an object is passed as message, the text message
is generated by calling String(message). If the cause option is provided,
it is assigned to the error.cause property. The error.stack property will
represent the point in the code at which new Error() was called. Stack traces
are dependent on V8’s stack trace API. Stack traces extend only to either
(a) the beginning of synchronous code execution, or (b) the number of frames
given by the property Error.stackTraceLimit, whichever is smaller.

Error.captureStackTrace(targetObject[, constructorOpt])

  • targetObject {Object}
  • constructorOpt {Function}

Creates a .stack property on targetObject, which when accessed returns
a string representing the location in the code at which
Error.captureStackTrace() was called.

const myObject = {};
Error.captureStackTrace(myObject);
myObject.stack;  // Similar to `new Error().stack`

The first line of the trace will be prefixed with
${myObject.name}: ${myObject.message}.

The optional constructorOpt argument accepts a function. If given, all frames
above constructorOpt, including constructorOpt, will be omitted from the
generated stack trace.

The constructorOpt argument is useful for hiding implementation
details of error generation from the user. For instance:

function MyError() {
  Error.captureStackTrace(this, MyError);
}

// Without passing MyError to captureStackTrace, the MyError
// frame would show up in the .stack property. By passing
// the constructor, we omit that frame, and retain all frames below it.
new MyError().stack;

Error.stackTraceLimit

  • {number}

The Error.stackTraceLimit property specifies the number of stack frames
collected by a stack trace (whether generated by new Error().stack or
Error.captureStackTrace(obj)).

The default value is 10 but may be set to any valid JavaScript number. Changes
will affect any stack trace captured after the value has been changed.

If set to a non-number value, or set to a negative number, stack traces will
not capture any frames.

error.cause

  • {any}

If present, the error.cause property is the underlying cause of the Error.
It is used when catching an error and throwing a new one with a different
message or code in order to still have access to the original error.

The error.cause property is typically set by calling
new Error(message, { cause }). It is not set by the constructor if the
cause option is not provided.

This property allows errors to be chained. When serializing Error objects,
util.inspect() recursively serializes error.cause if it is set.

const cause = new Error('The remote HTTP server responded with a 500 status');
const symptom = new Error('The message failed to send', { cause });

console.log(symptom);
// Prints:
//   Error: The message failed to send
//       at REPL2:1:17
//       at Script.runInThisContext (node:vm:130:12)
//       ... 7 lines matching cause stack trace ...
//       at [_line] [as _line] (node:internal/readline/interface:886:18) {
//     [cause]: Error: The remote HTTP server responded with a 500 status
//         at REPL1:1:15
//         at Script.runInThisContext (node:vm:130:12)
//         at REPLServer.defaultEval (node:repl:574:29)
//         at bound (node:domain:426:15)
//         at REPLServer.runBound [as eval] (node:domain:437:12)
//         at REPLServer.onLine (node:repl:902:10)
//         at REPLServer.emit (node:events:549:35)
//         at REPLServer.emit (node:domain:482:12)
//         at [_onLine] [as _onLine] (node:internal/readline/interface:425:12)
//         at [_line] [as _line] (node:internal/readline/interface:886:18)

error.code

  • {string}

The error.code property is a string label that identifies the kind of error.
error.code is the most stable way to identify an error. It will only change
between major versions of Node.js. In contrast, error.message strings may
change between any versions of Node.js. See Node.js error codes for details
about specific codes.

error.message

  • {string}

The error.message property is the string description of the error as set by
calling new Error(message). The message passed to the constructor will also
appear in the first line of the stack trace of the Error, however changing
this property after the Error object is created may not change the first
line of the stack trace (for example, when error.stack is read before this
property is changed).

const err = new Error('The message');
console.error(err.message);
// Prints: The message

error.stack

  • {string}

The error.stack property is a string describing the point in the code at which
the Error was instantiated.

Error: Things keep happening!
   at /home/gbusey/file.js:525:2
   at Frobnicator.refrobulate (/home/gbusey/business-logic.js:424:21)
   at Actor.<anonymous> (/home/gbusey/actors.js:400:8)
   at increaseSynergy (/home/gbusey/actors.js:701:6)

The first line is formatted as <error class name>: <error message>, and
is followed by a series of stack frames (each line beginning with «at «).
Each frame describes a call site within the code that lead to the error being
generated. V8 attempts to display a name for each function (by variable name,
function name, or object method name), but occasionally it will not be able to
find a suitable name. If V8 cannot determine a name for the function, only
location information will be displayed for that frame. Otherwise, the
determined function name will be displayed with location information appended
in parentheses.

Frames are only generated for JavaScript functions. If, for example, execution
synchronously passes through a C++ addon function called cheetahify which
itself calls a JavaScript function, the frame representing the cheetahify call
will not be present in the stack traces:

const cheetahify = require('./native-binding.node');

function makeFaster() {
  // `cheetahify()` *synchronously* calls speedy.
  cheetahify(function speedy() {
    throw new Error('oh no!');
  });
}

makeFaster();
// will throw:
//   /home/gbusey/file.js:6
//       throw new Error('oh no!');
//           ^
//   Error: oh no!
//       at speedy (/home/gbusey/file.js:6:11)
//       at makeFaster (/home/gbusey/file.js:5:3)
//       at Object.<anonymous> (/home/gbusey/file.js:10:1)
//       at Module._compile (module.js:456:26)
//       at Object.Module._extensions..js (module.js:474:10)
//       at Module.load (module.js:356:32)
//       at Function.Module._load (module.js:312:12)
//       at Function.Module.runMain (module.js:497:10)
//       at startup (node.js:119:16)
//       at node.js:906:3

The location information will be one of:

  • native, if the frame represents a call internal to V8 (as in [].forEach).
  • plain-filename.js:line:column, if the frame represents a call internal
    to Node.js.
  • /absolute/path/to/file.js:line:column, if the frame represents a call in
    a user program (using CommonJS module system), or its dependencies.
  • <transport-protocol>:///url/to/module/file.mjs:line:column, if the frame
    represents a call in a user program (using ES module system), or
    its dependencies.

The string representing the stack trace is lazily generated when the
error.stack property is accessed.

The number of frames captured by the stack trace is bounded by the smaller of
Error.stackTraceLimit or the number of available frames on the current event
loop tick.

Class: AssertionError

  • Extends: {errors.Error}

Indicates the failure of an assertion. For details, see
Class: assert.AssertionError.

Class: RangeError

  • Extends: {errors.Error}

Indicates that a provided argument was not within the set or range of
acceptable values for a function; whether that is a numeric range, or
outside the set of options for a given function parameter.

require('node:net').connect(-1);
// Throws "RangeError: "port" option should be >= 0 and < 65536: -1"

Node.js will generate and throw RangeError instances immediately as a form
of argument validation.

Class: ReferenceError

  • Extends: {errors.Error}

Indicates that an attempt is being made to access a variable that is not
defined. Such errors commonly indicate typos in code, or an otherwise broken
program.

While client code may generate and propagate these errors, in practice, only V8
will do so.

doesNotExist;
// Throws ReferenceError, doesNotExist is not a variable in this program.

Unless an application is dynamically generating and running code,
ReferenceError instances indicate a bug in the code or its dependencies.

Class: SyntaxError

  • Extends: {errors.Error}

Indicates that a program is not valid JavaScript. These errors may only be
generated and propagated as a result of code evaluation. Code evaluation may
happen as a result of eval, Function, require, or vm. These errors
are almost always indicative of a broken program.

try {
  require('node:vm').runInThisContext('binary ! isNotOk');
} catch (err) {
  // 'err' will be a SyntaxError.
}

SyntaxError instances are unrecoverable in the context that created them –
they may only be caught by other contexts.

Class: SystemError

  • Extends: {errors.Error}

Node.js generates system errors when exceptions occur within its runtime
environment. These usually occur when an application violates an operating
system constraint. For example, a system error will occur if an application
attempts to read a file that does not exist.

  • address {string} If present, the address to which a network connection
    failed
  • code {string} The string error code
  • dest {string} If present, the file path destination when reporting a file
    system error
  • errno {number} The system-provided error number
  • info {Object} If present, extra details about the error condition
  • message {string} A system-provided human-readable description of the error
  • path {string} If present, the file path when reporting a file system error
  • port {number} If present, the network connection port that is not available
  • syscall {string} The name of the system call that triggered the error

error.address

  • {string}

If present, error.address is a string describing the address to which a
network connection failed.

error.code

  • {string}

The error.code property is a string representing the error code.

error.dest

  • {string}

If present, error.dest is the file path destination when reporting a file
system error.

error.errno

  • {number}

The error.errno property is a negative number which corresponds
to the error code defined in libuv Error handling.

On Windows the error number provided by the system will be normalized by libuv.

To get the string representation of the error code, use
util.getSystemErrorName(error.errno).

error.info

  • {Object}

If present, error.info is an object with details about the error condition.

error.message

  • {string}

error.message is a system-provided human-readable description of the error.

error.path

  • {string}

If present, error.path is a string containing a relevant invalid pathname.

error.port

  • {number}

If present, error.port is the network connection port that is not available.

error.syscall

  • {string}

The error.syscall property is a string describing the syscall that failed.

Common system errors

This is a list of system errors commonly-encountered when writing a Node.js
program. For a comprehensive list, see the errno(3) man page.

  • EACCES (Permission denied): An attempt was made to access a file in a way
    forbidden by its file access permissions.

  • EADDRINUSE (Address already in use): An attempt to bind a server
    (net, http, or https) to a local address failed due to
    another server on the local system already occupying that address.

  • ECONNREFUSED (Connection refused): No connection could be made because the
    target machine actively refused it. This usually results from trying to
    connect to a service that is inactive on the foreign host.

  • ECONNRESET (Connection reset by peer): A connection was forcibly closed by
    a peer. This normally results from a loss of the connection on the remote
    socket due to a timeout or reboot. Commonly encountered via the http
    and net modules.

  • EEXIST (File exists): An existing file was the target of an operation that
    required that the target not exist.

  • EISDIR (Is a directory): An operation expected a file, but the given
    pathname was a directory.

  • EMFILE (Too many open files in system): Maximum number of
    file descriptors allowable on the system has been reached, and
    requests for another descriptor cannot be fulfilled until at least one
    has been closed. This is encountered when opening many files at once in
    parallel, especially on systems (in particular, macOS) where there is a low
    file descriptor limit for processes. To remedy a low limit, run
    ulimit -n 2048 in the same shell that will run the Node.js process.

  • ENOENT (No such file or directory): Commonly raised by fs operations
    to indicate that a component of the specified pathname does not exist. No
    entity (file or directory) could be found by the given path.

  • ENOTDIR (Not a directory): A component of the given pathname existed, but
    was not a directory as expected. Commonly raised by fs.readdir.

  • ENOTEMPTY (Directory not empty): A directory with entries was the target
    of an operation that requires an empty directory, usually fs.unlink.

  • ENOTFOUND (DNS lookup failed): Indicates a DNS failure of either
    EAI_NODATA or EAI_NONAME. This is not a standard POSIX error.

  • EPERM (Operation not permitted): An attempt was made to perform an
    operation that requires elevated privileges.

  • EPIPE (Broken pipe): A write on a pipe, socket, or FIFO for which there is
    no process to read the data. Commonly encountered at the net and
    http layers, indicative that the remote side of the stream being
    written to has been closed.

  • ETIMEDOUT (Operation timed out): A connect or send request failed because
    the connected party did not properly respond after a period of time. Usually
    encountered by http or net. Often a sign that a socket.end()
    was not properly called.

Class: TypeError

  • Extends {errors.Error}

Indicates that a provided argument is not an allowable type. For example,
passing a function to a parameter which expects a string would be a TypeError.

require('node:url').parse(() => { });
// Throws TypeError, since it expected a string.

Node.js will generate and throw TypeError instances immediately as a form
of argument validation.

Exceptions vs. errors

A JavaScript exception is a value that is thrown as a result of an invalid
operation or as the target of a throw statement. While it is not required
that these values are instances of Error or classes which inherit from
Error, all exceptions thrown by Node.js or the JavaScript runtime will be
instances of Error.

Some exceptions are unrecoverable at the JavaScript layer. Such exceptions
will always cause the Node.js process to crash. Examples include assert()
checks or abort() calls in the C++ layer.

OpenSSL errors

Errors originating in crypto or tls are of class Error, and in addition to
the standard .code and .message properties, may have some additional
OpenSSL-specific properties.

error.opensslErrorStack

An array of errors that can give context to where in the OpenSSL library an
error originates from.

error.function

The OpenSSL function the error originates in.

error.library

The OpenSSL library the error originates in.

error.reason

A human-readable string describing the reason for the error.

Node.js error codes

ABORT_ERR

Used when an operation has been aborted (typically using an AbortController).

APIs not using AbortSignals typically do not raise an error with this code.

This code does not use the regular ERR_* convention Node.js errors use in
order to be compatible with the web platform’s AbortError.

ERR_AMBIGUOUS_ARGUMENT

A function argument is being used in a way that suggests that the function
signature may be misunderstood. This is thrown by the node:assert module when
the message parameter in assert.throws(block, message) matches the error
message thrown by block because that usage suggests that the user believes
message is the expected message rather than the message the AssertionError
will display if block does not throw.

ERR_ARG_NOT_ITERABLE

An iterable argument (i.e. a value that works with for...of loops) was
required, but not provided to a Node.js API.

ERR_ASSERTION

A special type of error that can be triggered whenever Node.js detects an
exceptional logic violation that should never occur. These are raised typically
by the node:assert module.

ERR_ASYNC_CALLBACK

An attempt was made to register something that is not a function as an
AsyncHooks callback.

ERR_ASYNC_TYPE

The type of an asynchronous resource was invalid. Users are also able
to define their own types if using the public embedder API.

ERR_BROTLI_COMPRESSION_FAILED

Data passed to a Brotli stream was not successfully compressed.

ERR_BROTLI_INVALID_PARAM

An invalid parameter key was passed during construction of a Brotli stream.

ERR_BUFFER_CONTEXT_NOT_AVAILABLE

An attempt was made to create a Node.js Buffer instance from addon or embedder
code, while in a JS engine Context that is not associated with a Node.js
instance. The data passed to the Buffer method will have been released
by the time the method returns.

When encountering this error, a possible alternative to creating a Buffer
instance is to create a normal Uint8Array, which only differs in the
prototype of the resulting object. Uint8Arrays are generally accepted in all
Node.js core APIs where Buffers are; they are available in all Contexts.

ERR_BUFFER_OUT_OF_BOUNDS

An operation outside the bounds of a Buffer was attempted.

ERR_BUFFER_TOO_LARGE

An attempt has been made to create a Buffer larger than the maximum allowed
size.

ERR_CANNOT_WATCH_SIGINT

Node.js was unable to watch for the SIGINT signal.

ERR_CHILD_CLOSED_BEFORE_REPLY

A child process was closed before the parent received a reply.

ERR_CHILD_PROCESS_IPC_REQUIRED

Used when a child process is being forked without specifying an IPC channel.

ERR_CHILD_PROCESS_STDIO_MAXBUFFER

Used when the main process is trying to read data from the child process’s
STDERR/STDOUT, and the data’s length is longer than the maxBuffer option.

ERR_CLOSED_MESSAGE_PORT

There was an attempt to use a MessagePort instance in a closed
state, usually after .close() has been called.

ERR_CONSOLE_WRITABLE_STREAM

Console was instantiated without stdout stream, or Console has a
non-writable stdout or stderr stream.

ERR_CONSTRUCT_CALL_INVALID

A class constructor was called that is not callable.

ERR_CONSTRUCT_CALL_REQUIRED

A constructor for a class was called without new.

ERR_CONTEXT_NOT_INITIALIZED

The vm context passed into the API is not yet initialized. This could happen
when an error occurs (and is caught) during the creation of the
context, for example, when the allocation fails or the maximum call stack
size is reached when the context is created.

ERR_CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED

A client certificate engine was requested that is not supported by the version
of OpenSSL being used.

ERR_CRYPTO_ECDH_INVALID_FORMAT

An invalid value for the format argument was passed to the crypto.ECDH()
class getPublicKey() method.

ERR_CRYPTO_ECDH_INVALID_PUBLIC_KEY

An invalid value for the key argument has been passed to the
crypto.ECDH() class computeSecret() method. It means that the public
key lies outside of the elliptic curve.

ERR_CRYPTO_ENGINE_UNKNOWN

An invalid crypto engine identifier was passed to
require('node:crypto').setEngine().

ERR_CRYPTO_FIPS_FORCED

The --force-fips command-line argument was used but there was an attempt
to enable or disable FIPS mode in the node:crypto module.

ERR_CRYPTO_FIPS_UNAVAILABLE

An attempt was made to enable or disable FIPS mode, but FIPS mode was not
available.

ERR_CRYPTO_HASH_FINALIZED

hash.digest() was called multiple times. The hash.digest() method must
be called no more than one time per instance of a Hash object.

ERR_CRYPTO_HASH_UPDATE_FAILED

hash.update() failed for any reason. This should rarely, if ever, happen.

ERR_CRYPTO_INCOMPATIBLE_KEY

The given crypto keys are incompatible with the attempted operation.

ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS

The selected public or private key encoding is incompatible with other options.

ERR_CRYPTO_INITIALIZATION_FAILED

Initialization of the crypto subsystem failed.

ERR_CRYPTO_INVALID_AUTH_TAG

An invalid authentication tag was provided.

ERR_CRYPTO_INVALID_COUNTER

An invalid counter was provided for a counter-mode cipher.

ERR_CRYPTO_INVALID_CURVE

An invalid elliptic-curve was provided.

ERR_CRYPTO_INVALID_DIGEST

An invalid crypto digest algorithm was specified.

ERR_CRYPTO_INVALID_IV

An invalid initialization vector was provided.

ERR_CRYPTO_INVALID_JWK

An invalid JSON Web Key was provided.

ERR_CRYPTO_INVALID_KEY_OBJECT_TYPE

The given crypto key object’s type is invalid for the attempted operation.

ERR_CRYPTO_INVALID_KEYLEN

An invalid key length was provided.

ERR_CRYPTO_INVALID_KEYPAIR

An invalid key pair was provided.

ERR_CRYPTO_INVALID_KEYTYPE

An invalid key type was provided.

ERR_CRYPTO_INVALID_MESSAGELEN

An invalid message length was provided.

ERR_CRYPTO_INVALID_SCRYPT_PARAMS

Invalid scrypt algorithm parameters were provided.

ERR_CRYPTO_INVALID_STATE

A crypto method was used on an object that was in an invalid state. For
instance, calling cipher.getAuthTag() before calling cipher.final().

ERR_CRYPTO_INVALID_TAG_LENGTH

An invalid authentication tag length was provided.

ERR_CRYPTO_JOB_INIT_FAILED

Initialization of an asynchronous crypto operation failed.

ERR_CRYPTO_JWK_UNSUPPORTED_CURVE

Key’s Elliptic Curve is not registered for use in the
JSON Web Key Elliptic Curve Registry.

ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE

Key’s Asymmetric Key Type is not registered for use in the
JSON Web Key Types Registry.

ERR_CRYPTO_OPERATION_FAILED

A crypto operation failed for an otherwise unspecified reason.

ERR_CRYPTO_PBKDF2_ERROR

The PBKDF2 algorithm failed for unspecified reasons. OpenSSL does not provide
more details and therefore neither does Node.js.

ERR_CRYPTO_SCRYPT_INVALID_PARAMETER

One or more crypto.scrypt() or crypto.scryptSync() parameters are
outside their legal range.

ERR_CRYPTO_SCRYPT_NOT_SUPPORTED

Node.js was compiled without scrypt support. Not possible with the official
release binaries but can happen with custom builds, including distro builds.

ERR_CRYPTO_SIGN_KEY_REQUIRED

A signing key was not provided to the sign.sign() method.

ERR_CRYPTO_TIMING_SAFE_EQUAL_LENGTH

crypto.timingSafeEqual() was called with Buffer, TypedArray, or
DataView arguments of different lengths.

ERR_CRYPTO_UNKNOWN_CIPHER

An unknown cipher was specified.

ERR_CRYPTO_UNKNOWN_DH_GROUP

An unknown Diffie-Hellman group name was given. See
crypto.getDiffieHellman() for a list of valid group names.

ERR_CRYPTO_UNSUPPORTED_OPERATION

An attempt to invoke an unsupported crypto operation was made.

ERR_DEBUGGER_ERROR

An error occurred with the debugger.

ERR_DEBUGGER_STARTUP_ERROR

The debugger timed out waiting for the required host/port to be free.

ERR_DLOPEN_DISABLED

Loading native addons has been disabled using --no-addons.

ERR_DLOPEN_FAILED

A call to process.dlopen() failed.

ERR_DIR_CLOSED

The fs.Dir was previously closed.

ERR_DIR_CONCURRENT_OPERATION

A synchronous read or close call was attempted on an fs.Dir which has
ongoing asynchronous operations.

ERR_DNS_SET_SERVERS_FAILED

c-ares failed to set the DNS server.

ERR_DOMAIN_CALLBACK_NOT_AVAILABLE

The node:domain module was not usable since it could not establish the
required error handling hooks, because
process.setUncaughtExceptionCaptureCallback() had been called at an
earlier point in time.

ERR_DOMAIN_CANNOT_SET_UNCAUGHT_EXCEPTION_CAPTURE

process.setUncaughtExceptionCaptureCallback() could not be called
because the node:domain module has been loaded at an earlier point in time.

The stack trace is extended to include the point in time at which the
node:domain module had been loaded.

ERR_DUPLICATE_STARTUP_SNAPSHOT_MAIN_FUNCTION

v8.startupSnapshot.setDeserializeMainFunction() could not be called
because it had already been called before.

ERR_ENCODING_INVALID_ENCODED_DATA

Data provided to TextDecoder() API was invalid according to the encoding
provided.

ERR_ENCODING_NOT_SUPPORTED

Encoding provided to TextDecoder() API was not one of the
WHATWG Supported Encodings.

ERR_EVAL_ESM_CANNOT_PRINT

--print cannot be used with ESM input.

ERR_EVENT_RECURSION

Thrown when an attempt is made to recursively dispatch an event on EventTarget.

ERR_EXECUTION_ENVIRONMENT_NOT_AVAILABLE

The JS execution context is not associated with a Node.js environment.
This may occur when Node.js is used as an embedded library and some hooks
for the JS engine are not set up properly.

ERR_FALSY_VALUE_REJECTION

A Promise that was callbackified via util.callbackify() was rejected with a
falsy value.

ERR_FEATURE_UNAVAILABLE_ON_PLATFORM

Used when a feature that is not available
to the current platform which is running Node.js is used.

ERR_FS_CP_DIR_TO_NON_DIR

An attempt was made to copy a directory to a non-directory (file, symlink,
etc.) using fs.cp().

ERR_FS_CP_EEXIST

An attempt was made to copy over a file that already existed with
fs.cp(), with the force and errorOnExist set to true.

ERR_FS_CP_EINVAL

When using fs.cp(), src or dest pointed to an invalid path.

ERR_HTTP_CONTENT_LENGTH_MISMATCH

Response body size doesn’t match with the specified content-length header value.

ERR_FS_CP_FIFO_PIPE

An attempt was made to copy a named pipe with fs.cp().

ERR_FS_CP_NON_DIR_TO_DIR

An attempt was made to copy a non-directory (file, symlink, etc.) to a directory
using fs.cp().

ERR_FS_CP_SOCKET

An attempt was made to copy to a socket with fs.cp().

ERR_FS_CP_SYMLINK_TO_SUBDIRECTORY

When using fs.cp(), a symlink in dest pointed to a subdirectory
of src.

ERR_FS_CP_UNKNOWN

An attempt was made to copy to an unknown file type with fs.cp().

ERR_FS_EISDIR

Path is a directory.

ERR_FS_FILE_TOO_LARGE

An attempt has been made to read a file whose size is larger than the maximum
allowed size for a Buffer.

ERR_FS_INVALID_SYMLINK_TYPE

An invalid symlink type was passed to the fs.symlink() or
fs.symlinkSync() methods.

ERR_HTTP_HEADERS_SENT

An attempt was made to add more headers after the headers had already been sent.

ERR_HTTP_INVALID_HEADER_VALUE

An invalid HTTP header value was specified.

ERR_HTTP_INVALID_STATUS_CODE

Status code was outside the regular status code range (100-999).

ERR_HTTP_REQUEST_TIMEOUT

The client has not sent the entire request within the allowed time.

ERR_HTTP_SOCKET_ENCODING

Changing the socket encoding is not allowed per RFC 7230 Section 3.

ERR_HTTP_TRAILER_INVALID

The Trailer header was set even though the transfer encoding does not support
that.

ERR_HTTP2_ALTSVC_INVALID_ORIGIN

HTTP/2 ALTSVC frames require a valid origin.

ERR_HTTP2_ALTSVC_LENGTH

HTTP/2 ALTSVC frames are limited to a maximum of 16,382 payload bytes.

ERR_HTTP2_CONNECT_AUTHORITY

For HTTP/2 requests using the CONNECT method, the :authority pseudo-header
is required.

ERR_HTTP2_CONNECT_PATH

For HTTP/2 requests using the CONNECT method, the :path pseudo-header is
forbidden.

ERR_HTTP2_CONNECT_SCHEME

For HTTP/2 requests using the CONNECT method, the :scheme pseudo-header is
forbidden.

ERR_HTTP2_ERROR

A non-specific HTTP/2 error has occurred.

ERR_HTTP2_GOAWAY_SESSION

New HTTP/2 Streams may not be opened after the Http2Session has received a
GOAWAY frame from the connected peer.

ERR_HTTP2_HEADER_SINGLE_VALUE

Multiple values were provided for an HTTP/2 header field that was required to
have only a single value.

ERR_HTTP2_HEADERS_AFTER_RESPOND

An additional headers was specified after an HTTP/2 response was initiated.

ERR_HTTP2_HEADERS_SENT

An attempt was made to send multiple response headers.

ERR_HTTP2_INFO_STATUS_NOT_ALLOWED

Informational HTTP status codes (1xx) may not be set as the response status
code on HTTP/2 responses.

ERR_HTTP2_INVALID_CONNECTION_HEADERS

HTTP/1 connection specific headers are forbidden to be used in HTTP/2
requests and responses.

ERR_HTTP2_INVALID_HEADER_VALUE

An invalid HTTP/2 header value was specified.

ERR_HTTP2_INVALID_INFO_STATUS

An invalid HTTP informational status code has been specified. Informational
status codes must be an integer between 100 and 199 (inclusive).

ERR_HTTP2_INVALID_ORIGIN

HTTP/2 ORIGIN frames require a valid origin.

ERR_HTTP2_INVALID_PACKED_SETTINGS_LENGTH

Input Buffer and Uint8Array instances passed to the
http2.getUnpackedSettings() API must have a length that is a multiple of
six.

ERR_HTTP2_INVALID_PSEUDOHEADER

Only valid HTTP/2 pseudoheaders (:status, :path, :authority, :scheme,
and :method) may be used.

ERR_HTTP2_INVALID_SESSION

An action was performed on an Http2Session object that had already been
destroyed.

ERR_HTTP2_INVALID_SETTING_VALUE

An invalid value has been specified for an HTTP/2 setting.

ERR_HTTP2_INVALID_STREAM

An operation was performed on a stream that had already been destroyed.

ERR_HTTP2_MAX_PENDING_SETTINGS_ACK

Whenever an HTTP/2 SETTINGS frame is sent to a connected peer, the peer is
required to send an acknowledgment that it has received and applied the new
SETTINGS. By default, a maximum number of unacknowledged SETTINGS frames may
be sent at any given time. This error code is used when that limit has been
reached.

ERR_HTTP2_NESTED_PUSH

An attempt was made to initiate a new push stream from within a push stream.
Nested push streams are not permitted.

ERR_HTTP2_NO_MEM

Out of memory when using the http2session.setLocalWindowSize(windowSize) API.

ERR_HTTP2_NO_SOCKET_MANIPULATION

An attempt was made to directly manipulate (read, write, pause, resume, etc.) a
socket attached to an Http2Session.

ERR_HTTP2_ORIGIN_LENGTH

HTTP/2 ORIGIN frames are limited to a length of 16382 bytes.

ERR_HTTP2_OUT_OF_STREAMS

The number of streams created on a single HTTP/2 session reached the maximum
limit.

ERR_HTTP2_PAYLOAD_FORBIDDEN

A message payload was specified for an HTTP response code for which a payload is
forbidden.

ERR_HTTP2_PING_CANCEL

An HTTP/2 ping was canceled.

ERR_HTTP2_PING_LENGTH

HTTP/2 ping payloads must be exactly 8 bytes in length.

ERR_HTTP2_PSEUDOHEADER_NOT_ALLOWED

An HTTP/2 pseudo-header has been used inappropriately. Pseudo-headers are header
key names that begin with the : prefix.

ERR_HTTP2_PUSH_DISABLED

An attempt was made to create a push stream, which had been disabled by the
client.

ERR_HTTP2_SEND_FILE

An attempt was made to use the Http2Stream.prototype.responseWithFile() API to
send a directory.

ERR_HTTP2_SEND_FILE_NOSEEK

An attempt was made to use the Http2Stream.prototype.responseWithFile() API to
send something other than a regular file, but offset or length options were
provided.

ERR_HTTP2_SESSION_ERROR

The Http2Session closed with a non-zero error code.

ERR_HTTP2_SETTINGS_CANCEL

The Http2Session settings canceled.

ERR_HTTP2_SOCKET_BOUND

An attempt was made to connect a Http2Session object to a net.Socket or
tls.TLSSocket that had already been bound to another Http2Session object.

ERR_HTTP2_SOCKET_UNBOUND

An attempt was made to use the socket property of an Http2Session that
has already been closed.

ERR_HTTP2_STATUS_101

Use of the 101 Informational status code is forbidden in HTTP/2.

ERR_HTTP2_STATUS_INVALID

An invalid HTTP status code has been specified. Status codes must be an integer
between 100 and 599 (inclusive).

ERR_HTTP2_STREAM_CANCEL

An Http2Stream was destroyed before any data was transmitted to the connected
peer.

ERR_HTTP2_STREAM_ERROR

A non-zero error code was been specified in an RST_STREAM frame.

ERR_HTTP2_STREAM_SELF_DEPENDENCY

When setting the priority for an HTTP/2 stream, the stream may be marked as
a dependency for a parent stream. This error code is used when an attempt is
made to mark a stream and dependent of itself.

ERR_HTTP2_TOO_MANY_INVALID_FRAMES

The limit of acceptable invalid HTTP/2 protocol frames sent by the peer,
as specified through the maxSessionInvalidFrames option, has been exceeded.

ERR_HTTP2_TRAILERS_ALREADY_SENT

Trailing headers have already been sent on the Http2Stream.

ERR_HTTP2_TRAILERS_NOT_READY

The http2stream.sendTrailers() method cannot be called until after the
'wantTrailers' event is emitted on an Http2Stream object. The
'wantTrailers' event will only be emitted if the waitForTrailers option
is set for the Http2Stream.

ERR_HTTP2_UNSUPPORTED_PROTOCOL

http2.connect() was passed a URL that uses any protocol other than http: or
https:.

ERR_ILLEGAL_CONSTRUCTOR

An attempt was made to construct an object using a non-public constructor.

ERR_IMPORT_ASSERTION_TYPE_FAILED

An import assertion has failed, preventing the specified module to be imported.

ERR_IMPORT_ASSERTION_TYPE_MISSING

An import assertion is missing, preventing the specified module to be imported.

ERR_IMPORT_ASSERTION_TYPE_UNSUPPORTED

An import assertion is not supported by this version of Node.js.

ERR_INCOMPATIBLE_OPTION_PAIR

An option pair is incompatible with each other and cannot be used at the same
time.

ERR_INPUT_TYPE_NOT_ALLOWED

Stability: 1 — Experimental

The --input-type flag was used to attempt to execute a file. This flag can
only be used with input via --eval, --print, or STDIN.

ERR_INSPECTOR_ALREADY_ACTIVATED

While using the node:inspector module, an attempt was made to activate the
inspector when it already started to listen on a port. Use inspector.close()
before activating it on a different address.

ERR_INSPECTOR_ALREADY_CONNECTED

While using the node:inspector module, an attempt was made to connect when the
inspector was already connected.

ERR_INSPECTOR_CLOSED

While using the node:inspector module, an attempt was made to use the
inspector after the session had already closed.

ERR_INSPECTOR_COMMAND

An error occurred while issuing a command via the node:inspector module.

ERR_INSPECTOR_NOT_ACTIVE

The inspector is not active when inspector.waitForDebugger() is called.

ERR_INSPECTOR_NOT_AVAILABLE

The node:inspector module is not available for use.

ERR_INSPECTOR_NOT_CONNECTED

While using the node:inspector module, an attempt was made to use the
inspector before it was connected.

ERR_INSPECTOR_NOT_WORKER

An API was called on the main thread that can only be used from
the worker thread.

ERR_INTERNAL_ASSERTION

There was a bug in Node.js or incorrect usage of Node.js internals.
To fix the error, open an issue at https://github.com/nodejs/node/issues.

ERR_INVALID_ADDRESS_FAMILY

The provided address family is not understood by the Node.js API.

ERR_INVALID_ARG_TYPE

An argument of the wrong type was passed to a Node.js API.

ERR_INVALID_ARG_VALUE

An invalid or unsupported value was passed for a given argument.

ERR_INVALID_ASYNC_ID

An invalid asyncId or triggerAsyncId was passed using AsyncHooks. An id
less than -1 should never happen.

ERR_INVALID_BUFFER_SIZE

A swap was performed on a Buffer but its size was not compatible with the
operation.

ERR_INVALID_CHAR

Invalid characters were detected in headers.

ERR_INVALID_CURSOR_POS

A cursor on a given stream cannot be moved to a specified row without a
specified column.

ERR_INVALID_FD

A file descriptor (‘fd’) was not valid (e.g. it was a negative value).

ERR_INVALID_FD_TYPE

A file descriptor (‘fd’) type was not valid.

ERR_INVALID_FILE_URL_HOST

A Node.js API that consumes file: URLs (such as certain functions in the
fs module) encountered a file URL with an incompatible host. This
situation can only occur on Unix-like systems where only localhost or an empty
host is supported.

ERR_INVALID_FILE_URL_PATH

A Node.js API that consumes file: URLs (such as certain functions in the
fs module) encountered a file URL with an incompatible path. The exact
semantics for determining whether a path can be used is platform-dependent.

ERR_INVALID_HANDLE_TYPE

An attempt was made to send an unsupported «handle» over an IPC communication
channel to a child process. See subprocess.send() and process.send()
for more information.

ERR_INVALID_HTTP_TOKEN

An invalid HTTP token was supplied.

ERR_INVALID_IP_ADDRESS

An IP address is not valid.

ERR_INVALID_MIME_SYNTAX

The syntax of a MIME is not valid.

ERR_INVALID_MODULE

An attempt was made to load a module that does not exist or was otherwise not
valid.

ERR_INVALID_MODULE_SPECIFIER

The imported module string is an invalid URL, package name, or package subpath
specifier.

ERR_INVALID_OBJECT_DEFINE_PROPERTY

An error occurred while setting an invalid attribute on the property of
an object.

ERR_INVALID_PACKAGE_CONFIG

An invalid package.json file failed parsing.

ERR_INVALID_PACKAGE_TARGET

The package.json "exports" field contains an invalid target mapping
value for the attempted module resolution.

ERR_INVALID_PERFORMANCE_MARK

While using the Performance Timing API (perf_hooks), a performance mark is
invalid.

ERR_INVALID_PROTOCOL

An invalid options.protocol was passed to http.request().

ERR_INVALID_REPL_EVAL_CONFIG

Both breakEvalOnSigint and eval options were set in the REPL config,
which is not supported.

ERR_INVALID_REPL_INPUT

The input may not be used in the REPL. The conditions under which this
error is used are described in the REPL documentation.

ERR_INVALID_RETURN_PROPERTY

Thrown in case a function option does not provide a valid value for one of its
returned object properties on execution.

ERR_INVALID_RETURN_PROPERTY_VALUE

Thrown in case a function option does not provide an expected value
type for one of its returned object properties on execution.

ERR_INVALID_RETURN_VALUE

Thrown in case a function option does not return an expected value
type on execution, such as when a function is expected to return a promise.

ERR_INVALID_STATE

Indicates that an operation cannot be completed due to an invalid state.
For instance, an object may have already been destroyed, or may be
performing another operation.

ERR_INVALID_SYNC_FORK_INPUT

A Buffer, TypedArray, DataView, or string was provided as stdio input to
an asynchronous fork. See the documentation for the child_process module
for more information.

ERR_INVALID_THIS

A Node.js API function was called with an incompatible this value.

const urlSearchParams = new URLSearchParams('foo=bar&baz=new');

const buf = Buffer.alloc(1);
urlSearchParams.has.call(buf, 'foo');
// Throws a TypeError with code 'ERR_INVALID_THIS'

ERR_INVALID_TRANSFER_OBJECT

An invalid transfer object was passed to postMessage().

ERR_INVALID_TUPLE

An element in the iterable provided to the WHATWG
URLSearchParams constructor did not
represent a [name, value] tuple – that is, if an element is not iterable, or
does not consist of exactly two elements.

ERR_INVALID_URI

An invalid URI was passed.

ERR_INVALID_URL

An invalid URL was passed to the WHATWG URL
constructor or the legacy url.parse() to be parsed.
The thrown error object typically has an additional property 'input' that
contains the URL that failed to parse.

ERR_INVALID_URL_SCHEME

An attempt was made to use a URL of an incompatible scheme (protocol) for a
specific purpose. It is only used in the WHATWG URL API support in the
fs module (which only accepts URLs with 'file' scheme), but may be used
in other Node.js APIs as well in the future.

ERR_IPC_CHANNEL_CLOSED

An attempt was made to use an IPC communication channel that was already closed.

ERR_IPC_DISCONNECTED

An attempt was made to disconnect an IPC communication channel that was already
disconnected. See the documentation for the child_process module
for more information.

ERR_IPC_ONE_PIPE

An attempt was made to create a child Node.js process using more than one IPC
communication channel. See the documentation for the child_process module
for more information.

ERR_IPC_SYNC_FORK

An attempt was made to open an IPC communication channel with a synchronously
forked Node.js process. See the documentation for the child_process module
for more information.

ERR_LOADER_CHAIN_INCOMPLETE

An ESM loader hook returned without calling next() and without explicitly
signaling a short circuit.

ERR_MANIFEST_ASSERT_INTEGRITY

An attempt was made to load a resource, but the resource did not match the
integrity defined by the policy manifest. See the documentation for policy
manifests for more information.

ERR_MANIFEST_DEPENDENCY_MISSING

An attempt was made to load a resource, but the resource was not listed as a
dependency from the location that attempted to load it. See the documentation
for policy manifests for more information.

ERR_MANIFEST_INTEGRITY_MISMATCH

An attempt was made to load a policy manifest, but the manifest had multiple
entries for a resource which did not match each other. Update the manifest
entries to match in order to resolve this error. See the documentation for
policy manifests for more information.

ERR_MANIFEST_INVALID_RESOURCE_FIELD

A policy manifest resource had an invalid value for one of its fields. Update
the manifest entry to match in order to resolve this error. See the
documentation for policy manifests for more information.

ERR_MANIFEST_INVALID_SPECIFIER

A policy manifest resource had an invalid value for one of its dependency
mappings. Update the manifest entry to match to resolve this error. See the
documentation for policy manifests for more information.

ERR_MANIFEST_PARSE_POLICY

An attempt was made to load a policy manifest, but the manifest was unable to
be parsed. See the documentation for policy manifests for more information.

ERR_MANIFEST_TDZ

An attempt was made to read from a policy manifest, but the manifest
initialization has not yet taken place. This is likely a bug in Node.js.

ERR_MANIFEST_UNKNOWN_ONERROR

A policy manifest was loaded, but had an unknown value for its «onerror»
behavior. See the documentation for policy manifests for more information.

ERR_MEMORY_ALLOCATION_FAILED

An attempt was made to allocate memory (usually in the C++ layer) but it
failed.

ERR_MESSAGE_TARGET_CONTEXT_UNAVAILABLE

A message posted to a MessagePort could not be deserialized in the target
vm Context. Not all Node.js objects can be successfully instantiated in
any context at this time, and attempting to transfer them using postMessage()
can fail on the receiving side in that case.

ERR_METHOD_NOT_IMPLEMENTED

A method is required but not implemented.

ERR_MISSING_ARGS

A required argument of a Node.js API was not passed. This is only used for
strict compliance with the API specification (which in some cases may accept
func(undefined) but not func()). In most native Node.js APIs,
func(undefined) and func() are treated identically, and the
ERR_INVALID_ARG_TYPE error code may be used instead.

ERR_MISSING_OPTION

For APIs that accept options objects, some options might be mandatory. This code
is thrown if a required option is missing.

ERR_MISSING_PASSPHRASE

An attempt was made to read an encrypted key without specifying a passphrase.

ERR_MISSING_PLATFORM_FOR_WORKER

The V8 platform used by this instance of Node.js does not support creating
Workers. This is caused by lack of embedder support for Workers. In particular,
this error will not occur with standard builds of Node.js.

ERR_MISSING_TRANSFERABLE_IN_TRANSFER_LIST

An object that needs to be explicitly listed in the transferList argument
is in the object passed to a postMessage() call, but is not provided
in the transferList for that call. Usually, this is a MessagePort.

In Node.js versions prior to v15.0.0, the error code being used here was
ERR_MISSING_MESSAGE_PORT_IN_TRANSFER_LIST. However, the set of
transferable object types has been expanded to cover more types than
MessagePort.

ERR_MODULE_NOT_FOUND

A module file could not be resolved by the ECMAScript modules loader while
attempting an import operation or when loading the program entry point.

ERR_MULTIPLE_CALLBACK

A callback was called more than once.

A callback is almost always meant to only be called once as the query
can either be fulfilled or rejected but not both at the same time. The latter
would be possible by calling a callback more than once.

ERR_NAPI_CONS_FUNCTION

While using Node-API, a constructor passed was not a function.

ERR_NAPI_INVALID_DATAVIEW_ARGS

While calling napi_create_dataview(), a given offset was outside the bounds
of the dataview or offset + length was larger than a length of given buffer.

ERR_NAPI_INVALID_TYPEDARRAY_ALIGNMENT

While calling napi_create_typedarray(), the provided offset was not a
multiple of the element size.

ERR_NAPI_INVALID_TYPEDARRAY_LENGTH

While calling napi_create_typedarray(), (length * size_of_element) + byte_offset was larger than the length of given buffer.

ERR_NAPI_TSFN_CALL_JS

An error occurred while invoking the JavaScript portion of the thread-safe
function.

ERR_NAPI_TSFN_GET_UNDEFINED

An error occurred while attempting to retrieve the JavaScript undefined
value.

ERR_NAPI_TSFN_START_IDLE_LOOP

On the main thread, values are removed from the queue associated with the
thread-safe function in an idle loop. This error indicates that an error
has occurred when attempting to start the loop.

ERR_NAPI_TSFN_STOP_IDLE_LOOP

Once no more items are left in the queue, the idle loop must be suspended. This
error indicates that the idle loop has failed to stop.

ERR_NOT_BUILDING_SNAPSHOT

An attempt was made to use operations that can only be used when building
V8 startup snapshot even though Node.js isn’t building one.

ERR_NO_CRYPTO

An attempt was made to use crypto features while Node.js was not compiled with
OpenSSL crypto support.

ERR_NO_ICU

An attempt was made to use features that require ICU, but Node.js was not
compiled with ICU support.

ERR_NON_CONTEXT_AWARE_DISABLED

A non-context-aware native addon was loaded in a process that disallows them.

ERR_OUT_OF_RANGE

A given value is out of the accepted range.

ERR_PACKAGE_IMPORT_NOT_DEFINED

The package.json "imports" field does not define the given internal
package specifier mapping.

ERR_PACKAGE_PATH_NOT_EXPORTED

The package.json "exports" field does not export the requested subpath.
Because exports are encapsulated, private internal modules that are not exported
cannot be imported through the package resolution, unless using an absolute URL.

ERR_PARSE_ARGS_INVALID_OPTION_VALUE

When strict set to true, thrown by util.parseArgs() if a {boolean}
value is provided for an option of type {string}, or if a {string}
value is provided for an option of type {boolean}.

ERR_PARSE_ARGS_UNEXPECTED_POSITIONAL

Thrown by util.parseArgs(), when a positional argument is provided and
allowPositionals is set to false.

ERR_PARSE_ARGS_UNKNOWN_OPTION

When strict set to true, thrown by util.parseArgs() if an argument
is not configured in options.

ERR_PERFORMANCE_INVALID_TIMESTAMP

An invalid timestamp value was provided for a performance mark or measure.

ERR_PERFORMANCE_MEASURE_INVALID_OPTIONS

Invalid options were provided for a performance measure.

ERR_PROTO_ACCESS

Accessing Object.prototype.__proto__ has been forbidden using
--disable-proto=throw. Object.getPrototypeOf and
Object.setPrototypeOf should be used to get and set the prototype of an
object.

ERR_REQUIRE_ESM

Stability: 1 — Experimental

An attempt was made to require() an ES Module.

ERR_SCRIPT_EXECUTION_INTERRUPTED

Script execution was interrupted by SIGINT (For
example, Ctrl+C was pressed.)

ERR_SCRIPT_EXECUTION_TIMEOUT

Script execution timed out, possibly due to bugs in the script being executed.

ERR_SERVER_ALREADY_LISTEN

The server.listen() method was called while a net.Server was already
listening. This applies to all instances of net.Server, including HTTP, HTTPS,
and HTTP/2 Server instances.

ERR_SERVER_NOT_RUNNING

The server.close() method was called when a net.Server was not
running. This applies to all instances of net.Server, including HTTP, HTTPS,
and HTTP/2 Server instances.

ERR_SOCKET_ALREADY_BOUND

An attempt was made to bind a socket that has already been bound.

ERR_SOCKET_BAD_BUFFER_SIZE

An invalid (negative) size was passed for either the recvBufferSize or
sendBufferSize options in dgram.createSocket().

ERR_SOCKET_BAD_PORT

An API function expecting a port >= 0 and < 65536 received an invalid value.

ERR_SOCKET_BAD_TYPE

An API function expecting a socket type (udp4 or udp6) received an invalid
value.

ERR_SOCKET_BUFFER_SIZE

While using dgram.createSocket(), the size of the receive or send Buffer
could not be determined.

ERR_SOCKET_CLOSED

An attempt was made to operate on an already closed socket.

ERR_SOCKET_CLOSED_BEFORE_CONNECTION

When calling net.Socket.write() on a connecting socket and the socket was
closed before the connection was established.

ERR_SOCKET_DGRAM_IS_CONNECTED

A dgram.connect() call was made on an already connected socket.

ERR_SOCKET_DGRAM_NOT_CONNECTED

A dgram.disconnect() or dgram.remoteAddress() call was made on a
disconnected socket.

ERR_SOCKET_DGRAM_NOT_RUNNING

A call was made and the UDP subsystem was not running.

ERR_SRI_PARSE

A string was provided for a Subresource Integrity check, but was unable to be
parsed. Check the format of integrity attributes by looking at the
Subresource Integrity specification.

ERR_STREAM_ALREADY_FINISHED

A stream method was called that cannot complete because the stream was
finished.

ERR_STREAM_CANNOT_PIPE

An attempt was made to call stream.pipe() on a Writable stream.

ERR_STREAM_DESTROYED

A stream method was called that cannot complete because the stream was
destroyed using stream.destroy().

ERR_STREAM_NULL_VALUES

An attempt was made to call stream.write() with a null chunk.

ERR_STREAM_PREMATURE_CLOSE

An error returned by stream.finished() and stream.pipeline(), when a stream
or a pipeline ends non gracefully with no explicit error.

ERR_STREAM_PUSH_AFTER_EOF

An attempt was made to call stream.push() after a null(EOF) had been
pushed to the stream.

ERR_STREAM_UNSHIFT_AFTER_END_EVENT

An attempt was made to call stream.unshift() after the 'end' event was
emitted.

ERR_STREAM_WRAP

Prevents an abort if a string decoder was set on the Socket or if the decoder
is in objectMode.

const Socket = require('node:net').Socket;
const instance = new Socket();

instance.setEncoding('utf8');

ERR_STREAM_WRITE_AFTER_END

An attempt was made to call stream.write() after stream.end() has been
called.

ERR_STRING_TOO_LONG

An attempt has been made to create a string longer than the maximum allowed
length.

ERR_SYNTHETIC

An artificial error object used to capture the call stack for diagnostic
reports.

ERR_SYSTEM_ERROR

An unspecified or non-specific system error has occurred within the Node.js
process. The error object will have an err.info object property with
additional details.

ERR_TAP_LEXER_ERROR

An error representing a failing lexer state.

ERR_TAP_PARSER_ERROR

An error representing a failing parser state. Additional information about
the token causing the error is available via the cause property.

ERR_TAP_VALIDATION_ERROR

This error represents a failed TAP validation.

ERR_TEST_FAILURE

This error represents a failed test. Additional information about the failure
is available via the cause property. The failureType property specifies
what the test was doing when the failure occurred.

ERR_TLS_CERT_ALTNAME_FORMAT

This error is thrown by checkServerIdentity if a user-supplied
subjectaltname property violates encoding rules. Certificate objects produced
by Node.js itself always comply with encoding rules and will never cause
this error.

ERR_TLS_CERT_ALTNAME_INVALID

While using TLS, the host name/IP of the peer did not match any of the
subjectAltNames in its certificate.

ERR_TLS_DH_PARAM_SIZE

While using TLS, the parameter offered for the Diffie-Hellman (DH)
key-agreement protocol is too small. By default, the key length must be greater
than or equal to 1024 bits to avoid vulnerabilities, even though it is strongly
recommended to use 2048 bits or larger for stronger security.

ERR_TLS_HANDSHAKE_TIMEOUT

A TLS/SSL handshake timed out. In this case, the server must also abort the
connection.

ERR_TLS_INVALID_CONTEXT

The context must be a SecureContext.

ERR_TLS_INVALID_PROTOCOL_METHOD

The specified secureProtocol method is invalid. It is either unknown, or
disabled because it is insecure.

ERR_TLS_INVALID_PROTOCOL_VERSION

Valid TLS protocol versions are 'TLSv1', 'TLSv1.1', or 'TLSv1.2'.

ERR_TLS_INVALID_STATE

The TLS socket must be connected and securely established. Ensure the ‘secure’
event is emitted before continuing.

ERR_TLS_PROTOCOL_VERSION_CONFLICT

Attempting to set a TLS protocol minVersion or maxVersion conflicts with an
attempt to set the secureProtocol explicitly. Use one mechanism or the other.

ERR_TLS_PSK_SET_IDENTIY_HINT_FAILED

Failed to set PSK identity hint. Hint may be too long.

ERR_TLS_RENEGOTIATION_DISABLED

An attempt was made to renegotiate TLS on a socket instance with renegotiation
disabled.

ERR_TLS_REQUIRED_SERVER_NAME

While using TLS, the server.addContext() method was called without providing
a host name in the first parameter.

ERR_TLS_SESSION_ATTACK

An excessive amount of TLS renegotiations is detected, which is a potential
vector for denial-of-service attacks.

ERR_TLS_SNI_FROM_SERVER

An attempt was made to issue Server Name Indication from a TLS server-side
socket, which is only valid from a client.

ERR_TRACE_EVENTS_CATEGORY_REQUIRED

The trace_events.createTracing() method requires at least one trace event
category.

ERR_TRACE_EVENTS_UNAVAILABLE

The node:trace_events module could not be loaded because Node.js was compiled
with the --without-v8-platform flag.

ERR_TRANSFORM_ALREADY_TRANSFORMING

A Transform stream finished while it was still transforming.

ERR_TRANSFORM_WITH_LENGTH_0

A Transform stream finished with data still in the write buffer.

ERR_TTY_INIT_FAILED

The initialization of a TTY failed due to a system error.

ERR_UNAVAILABLE_DURING_EXIT

Function was called within a process.on('exit') handler that shouldn’t be
called within process.on('exit') handler.

ERR_UNCAUGHT_EXCEPTION_CAPTURE_ALREADY_SET

process.setUncaughtExceptionCaptureCallback() was called twice,
without first resetting the callback to null.

This error is designed to prevent accidentally overwriting a callback registered
from another module.

ERR_UNESCAPED_CHARACTERS

A string that contained unescaped characters was received.

ERR_UNHANDLED_ERROR

An unhandled error occurred (for instance, when an 'error' event is emitted
by an EventEmitter but an 'error' handler is not registered).

ERR_UNKNOWN_BUILTIN_MODULE

Used to identify a specific kind of internal Node.js error that should not
typically be triggered by user code. Instances of this error point to an
internal bug within the Node.js binary itself.

ERR_UNKNOWN_CREDENTIAL

A Unix group or user identifier that does not exist was passed.

ERR_UNKNOWN_ENCODING

An invalid or unknown encoding option was passed to an API.

ERR_UNKNOWN_FILE_EXTENSION

Stability: 1 — Experimental

An attempt was made to load a module with an unknown or unsupported file
extension.

ERR_UNKNOWN_MODULE_FORMAT

Stability: 1 — Experimental

An attempt was made to load a module with an unknown or unsupported format.

ERR_UNKNOWN_SIGNAL

An invalid or unknown process signal was passed to an API expecting a valid
signal (such as subprocess.kill()).

ERR_UNSUPPORTED_DIR_IMPORT

import a directory URL is unsupported. Instead,
self-reference a package using its name and define a custom subpath in
the "exports" field of the package.json file.

import './'; // unsupported
import './index.js'; // supported
import 'package-name'; // supported

ERR_UNSUPPORTED_ESM_URL_SCHEME

import with URL schemes other than file and data is unsupported.

ERR_USE_AFTER_CLOSE

Stability: 1 — Experimental

An attempt was made to use something that was already closed.

ERR_VALID_PERFORMANCE_ENTRY_TYPE

While using the Performance Timing API (perf_hooks), no valid performance
entry types are found.

ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING

A dynamic import callback was not specified.

ERR_VM_MODULE_ALREADY_LINKED

The module attempted to be linked is not eligible for linking, because of one of
the following reasons:

  • It has already been linked (linkingStatus is 'linked')
  • It is being linked (linkingStatus is 'linking')
  • Linking has failed for this module (linkingStatus is 'errored')

ERR_VM_MODULE_CACHED_DATA_REJECTED

The cachedData option passed to a module constructor is invalid.

ERR_VM_MODULE_CANNOT_CREATE_CACHED_DATA

Cached data cannot be created for modules which have already been evaluated.

ERR_VM_MODULE_DIFFERENT_CONTEXT

The module being returned from the linker function is from a different context
than the parent module. Linked modules must share the same context.

ERR_VM_MODULE_LINK_FAILURE

The module was unable to be linked due to a failure.

ERR_VM_MODULE_NOT_MODULE

The fulfilled value of a linking promise is not a vm.Module object.

ERR_VM_MODULE_STATUS

The current module’s status does not allow for this operation. The specific
meaning of the error depends on the specific function.

ERR_WASI_ALREADY_STARTED

The WASI instance has already started.

ERR_WASI_NOT_STARTED

The WASI instance has not been started.

ERR_WEBASSEMBLY_RESPONSE

The Response that has been passed to WebAssembly.compileStreaming or to
WebAssembly.instantiateStreaming is not a valid WebAssembly response.

ERR_WORKER_INIT_FAILED

The Worker initialization failed.

ERR_WORKER_INVALID_EXEC_ARGV

The execArgv option passed to the Worker constructor contains
invalid flags.

ERR_WORKER_NOT_RUNNING

An operation failed because the Worker instance is not currently running.

ERR_WORKER_OUT_OF_MEMORY

The Worker instance terminated because it reached its memory limit.

ERR_WORKER_PATH

The path for the main script of a worker is neither an absolute path
nor a relative path starting with ./ or ../.

ERR_WORKER_UNSERIALIZABLE_ERROR

All attempts at serializing an uncaught exception from a worker thread failed.

ERR_WORKER_UNSUPPORTED_OPERATION

The requested functionality is not supported in worker threads.

ERR_ZLIB_INITIALIZATION_FAILED

Creation of a zlib object failed due to incorrect configuration.

HPE_HEADER_OVERFLOW

Too much HTTP header data was received. In order to protect against malicious or
malconfigured clients, if more than 8 KiB of HTTP header data is received then
HTTP parsing will abort without a request or response object being created, and
an Error with this code will be emitted.

HPE_UNEXPECTED_CONTENT_LENGTH

Server is sending both a Content-Length header and Transfer-Encoding: chunked.

Transfer-Encoding: chunked allows the server to maintain an HTTP persistent
connection for dynamically generated content.
In this case, the Content-Length HTTP header cannot be used.

Use Content-Length or Transfer-Encoding: chunked.

MODULE_NOT_FOUND

A module file could not be resolved by the CommonJS modules loader while
attempting a require() operation or when loading the program entry point.

Legacy Node.js error codes

Stability: 0 — Deprecated. These error codes are either inconsistent, or have
been removed.

ERR_CANNOT_TRANSFER_OBJECT

The value passed to postMessage() contained an object that is not supported
for transferring.

ERR_CRYPTO_HASH_DIGEST_NO_UTF16

The UTF-16 encoding was used with hash.digest(). While the
hash.digest() method does allow an encoding argument to be passed in,
causing the method to return a string rather than a Buffer, the UTF-16
encoding (e.g. ucs or utf16le) is not supported.

ERR_HTTP2_FRAME_ERROR

Used when a failure occurs sending an individual frame on the HTTP/2
session.

ERR_HTTP2_HEADERS_OBJECT

Used when an HTTP/2 Headers Object is expected.

ERR_HTTP2_HEADER_REQUIRED

Used when a required header is missing in an HTTP/2 message.

ERR_HTTP2_INFO_HEADERS_AFTER_RESPOND

HTTP/2 informational headers must only be sent prior to calling the
Http2Stream.prototype.respond() method.

ERR_HTTP2_STREAM_CLOSED

Used when an action has been performed on an HTTP/2 Stream that has already
been closed.

ERR_HTTP_INVALID_CHAR

Used when an invalid character is found in an HTTP response status message
(reason phrase).

ERR_INDEX_OUT_OF_RANGE

A given index was out of the accepted range (e.g. negative offsets).

ERR_INVALID_OPT_VALUE

An invalid or unexpected value was passed in an options object.

ERR_INVALID_OPT_VALUE_ENCODING

An invalid or unknown file encoding was passed.

ERR_MISSING_MESSAGE_PORT_IN_TRANSFER_LIST

This error code was replaced by ERR_MISSING_TRANSFERABLE_IN_TRANSFER_LIST
in Node.js v15.0.0, because it is no longer accurate as other types of
transferable objects also exist now.

ERR_NAPI_CONS_PROTOTYPE_OBJECT

Used by the Node-API when Constructor.prototype is not an object.

ERR_NETWORK_IMPORT_BAD_RESPONSE

Stability: 1 — Experimental

Response was received but was invalid when importing a module over the network.

ERR_NETWORK_IMPORT_DISALLOWED

Stability: 1 — Experimental

A network module attempted to load another module that it is not allowed to
load. Likely this restriction is for security reasons.

ERR_NO_LONGER_SUPPORTED

A Node.js API was called in an unsupported manner, such as
Buffer.write(string, encoding, offset[, length]).

ERR_OPERATION_FAILED

An operation failed. This is typically used to signal the general failure
of an asynchronous operation.

ERR_OUTOFMEMORY

Used generically to identify that an operation caused an out of memory
condition.

ERR_PARSE_HISTORY_DATA

The node:repl module was unable to parse data from the REPL history file.

ERR_SOCKET_CANNOT_SEND

Data could not be sent on a socket.

ERR_STDERR_CLOSE

An attempt was made to close the process.stderr stream. By design, Node.js
does not allow stdout or stderr streams to be closed by user code.

ERR_STDOUT_CLOSE

An attempt was made to close the process.stdout stream. By design, Node.js
does not allow stdout or stderr streams to be closed by user code.

ERR_STREAM_READ_NOT_IMPLEMENTED

Used when an attempt is made to use a readable stream that has not implemented
readable._read().

ERR_TLS_RENEGOTIATION_FAILED

Used when a TLS renegotiation request has failed in a non-specific way.

ERR_TRANSFERRING_EXTERNALIZED_SHAREDARRAYBUFFER

A SharedArrayBuffer whose memory is not managed by the JavaScript engine
or by Node.js was encountered during serialization. Such a SharedArrayBuffer
cannot be serialized.

This can only happen when native addons create SharedArrayBuffers in
«externalized» mode, or put existing SharedArrayBuffer into externalized mode.

ERR_UNKNOWN_STDIN_TYPE

An attempt was made to launch a Node.js process with an unknown stdin file
type. This error is usually an indication of a bug within Node.js itself,
although it is possible for user code to trigger it.

ERR_UNKNOWN_STREAM_TYPE

An attempt was made to launch a Node.js process with an unknown stdout or
stderr file type. This error is usually an indication of a bug within Node.js
itself, although it is possible for user code to trigger it.

ERR_V8BREAKITERATOR

The V8 BreakIterator API was used but the full ICU data set is not installed.

ERR_VALUE_OUT_OF_RANGE

Used when a given value is out of the accepted range.

ERR_VM_MODULE_NOT_LINKED

The module must be successfully linked before instantiation.

ERR_VM_MODULE_LINKING_ERRORED

The linker function returned a module for which linking has failed.

ERR_WORKER_UNSUPPORTED_EXTENSION

The pathname used for the main script of a worker has an
unknown file extension.

ERR_ZLIB_BINDING_CLOSED

Used when an attempt is made to use a zlib object after it has already been
closed.

ERR_CPU_USAGE

The native call from process.cpuUsage could not be processed.

9 min read

Last Updated: April 6, 2021

This article is part of A Guide to Express API Validation.

Let’s be real, adding request validation to your Express based API isn’t particularly exciting, but you know that it is an important foundational part of building an API, so you sit down to figure out what you’re going to do.

You try and pick a validation library, but it’s more difficult than you expect because they’re all quite different from each other, and it’s not clear what benefits one has over another. Perhaps you start to build your own custom validation, but it quickly starts to feel very messy. You just want to be able to put something reliable in place for validation and move on to building the interesting stuff in your API. You wonder to yourself, is adding request validation to an Express API really this difficult?!

In this article I’ll introduce you to JSON Schema, which allows you to describe the format that you expect data to be in and then validate data against it. I’ll then show you how to use JSON Schema to validate requests to your Express based API and send validation errors back in the response. By the time we’re done you won’t have to waste time figuring out how to handle request validation ever again.

Jump links

  • Getting to grips with JSON Schema
  • Why should I use JSON Schema and not validation library X?
  • How to integrate validation with JSON schemas into your application
  • Pulling it all together
  • Wrapping things up
  • Handy JSON Schema links

Important Update (Nov 20, 2020 @ 13:15 UTC): The original version of this article had code snippets where the allErrors option was being passed to Ajv. Unfortunately this particular option currently opens you up to a security vulnerability and you should not use it. All code examples have been updated to remove this option. Thanks to Matteo Collina, Lead Maintainer of the Fastify framework, for making me aware of this issue.


Getting to grips with JSON Schema

JSON Schema is very powerful, but for now we’ll only use a few of its features so that we can get comfortable with how it works.

Here’s an example JSON schema showing some of the types and keywords which you can use to describe how an object should be structured:

{
	"type": "object",
	"required": ["name"],
	"properties": {
		"name": {
			"type": "string",
			"minLength": 1
		},
		"age": {
			"type": "integer",
			"minimum": 18
		}
	}
}

The nice thing about JSON Schema is that it tends to be self-documenting, which is great for us humans who want to quickly understand what’s going on. At the same time, JSON schemas are also machine readable, meaning that we can use a JSON Schema validator library to validate the data which our application receives against a schema.

I recommend you finish reading this article before diving deeper into all of the features of JSON Schema, but if you’re keen to learn more about them right now you can jump to the handy links I’ve collected at the end.

Why should I use JSON Schema and not validation library X?

Here are the things which I think make JSON Schema a uniquely ideal tool for data validation in your Node.js application.

No library, framework or language lock-in

There are JSON Schema validation libraries available for every popular programming language.

JSON Schema doesn’t tie you to a library or a framework e.g. Joi, Yup, validate.js. These Node.js libraries all take their own approach to defining validation rules and error messages, so the things you need to learn to use them will become obsolete if they stop being developed or become deprecated.

This almost happened with the Joi validation library earlier this year, when the lead maintainer of the Hapi.js framework which it was a part of announced plans to deprecate all modules. Fortunately Joi itself seems to have been adopted by some kind souls, but it should make you think twice about committing to a specific library when more widely supported tooling is available.

Move between Node.js frameworks, or even languages, and take your schemas with you

Because JSON schemas aren’t tied to a framework, it’s one less thing to worry about if you decide to migrate away from Express to something else e.g. Fastify, which has built in support for request validation and response serialization with JSON Schema.

Because JSON Schema itself is language agnostic and widely supported, if you ever decide to rewrite your Node.js applications in a completely different language e.g. Go or Rust, you won’t need to rewrite all of the validation – you can take your JSON schemas with you!

Active and supportive community

There is an active community of folks on Slack who are very willing to help you out. The official JSON Schema website has a link which you can use to join.

JSON Schema is on a path to becoming a standard

JSON Schema is on its way to becoming a standard. It’s currently defined in a collection of IETF Internet-Draft documents, with the intention that they will be adopted by an IETF Working Group and shepherded through to RFC status, making them eligible to become an Internet Standard.

How to integrate validation with JSON schemas into your application

First things first, parse that JSON request body

Your application will need to be able to handle POST requests with a JSON body, where the Content-Type header is application/json. Here’s an example of how you can make a request like this on the command line with cURL:

curl --request POST 
  --url http://localhost:3000/user 
  --header 'Content-Type: application/json' 
  --data '{
	"first_name": "Test",
	"last_name": "Person",
	"age": true
}'

In order for the routes in our Express application to be able to handle POST requests with a JSON body, we need to configure our application to use the built-in express.json() middleware:

/**
 * You can add the `json()` middleware anywhere after you've
 * created your Express application, but you must do it before
 * you define routes which expect a JSON request body.
 *
 * If a request with a `Content-Type: application/json` header is
 * made to a route, this middleware will treat the request body as
 * a JSON string. It will attempt to parse it with `JSON.parse()`
 * and set the resulting object (or array) on a `body` property of
 * the request object, which you can access in your route handlers,
 * or other general middleware.
 */
app.use(express.json());

This functionality has been available in Express since v4.16.0. If you’re using an older version of Express you will need to install and configure the body-parser middleware package.

Integrate Ajv (Another JSON Schema Validator) into your application

The Ajv (Another JSON Schema Validator) library is the most popular JSON Schema validator written for JavaScript (Node.js and browser). You can use Ajv directly, however for an Express based API it’s nice to be able to use middleware to validate request data which has been sent to an endpoint before that endpoint’s route handler is run. This allows you to prevent things like accidentally storing invalid data in your database. It also means that you can handle validation errors and send a useful error response back to the client. The express-json-validator-middleware package can help you with all of this.

The express-json-validator-middleware package uses Ajv and allows you to pass configuration options to it. This is great as it means you have full control to configure Ajv as if you were using it directly.

Before we integrate this middleware into our application, let’s get it installed:

npm install express-json-validator-middleware

Once you have it installed you need to require it in your application and configure it:

const { Validator } = require("express-json-validator-middleware");

/**
 * Create a new instance of the `express-json-validator-middleware`
 * `Validator` class and pass in Ajv options if needed.
 *
 * @see https://github.com/ajv-validator/ajv/blob/master/docs/api.md#options
 */
const { validate } = new Validator();

Using a JSON schema to validate a response

In this next code snippet we’re going to do two things:

  1. Define a JSON schema which describes the data which we expect to receive when a client calls our API endpoint to create a new user. We want the data to be an object which always has a first_name and a last_name property. This object can optionally include an age property, and if it does, the value of that property must be an integer which is greater than or equal to 18.
  2. We’re going to use the user schema which we’ve defined to validate requests to our POST /user API endpoint.
const userSchema = {
	type: "object",
	required: ["first_name", "last_name"],
	properties: {
		first_name: {
			type: "string",
			minLength: 1,
		},
		last_name: {
			type: "string",
			minLength: 1,
		},
		age: {
			type: "integer",
			minimum: 18,
		},
	},
};

/**
 * Here we're using the `validate()` method from our `Validator`
 * instance. We pass it an object telling it which request properties
 * we want to validate, and what JSON schema we want to validate the
 * value of each property against. In this example we are going to
 * validate the `body` property of any requests to the POST /user
 * endpoint against our `userSchema` JSON schema.
 *
 * The `validate()` method compiles the JSON schema with Ajv, and
 * then returns a middleware function which will be run every time a
 * request is made to this endpoint. This middleware function will
 * take care of running the validation which we've configured.
 *
 * If the request `body` validates against our `userSchema`, the
 * middleware function will call the `next()` Express function which
 * was passed to it and our route handler function will be run. If Ajv
 * returns a validation error, the middleware  will call the `next()`
 * Express function with an error object which has a `validationErrors`
 * property containing an array of validation errors, and our route handler
 * function will NOT be run. We'll look at where that error object gets
 * passed to and how we can handle it in the next step.
 */
app.post(
	"/user",
	validate({ body: userSchema }),
	function createUserRouteHandler(request, response, next) {
		/**
		 * Normally you'd save the data you've received to a database,
		 * but for this example we'll just send it back in the response.
		 */
		response.json(request.body);

		next();
	}
);

You can validate any property in the Express request object, such as query, which contains the URL query string parsed into an object. The Validating multiple request properties section of the express-json-validator-middleware documentation provides an example of this.

Sending validation errors in a response

In the previous code snippet we learnt how to integrate the express-json-validator-middleware so that it will validate a request body against our user schema. If there is a validation error, the middleware will call the next() Express function with an error object. This error object has a validationErrors property containing an array of validation errors. When an error object is passed to a next() Express function, it automatically stops calling all regular middleware for the current request, and starts calling any error handler middleware which has been configured.

Note: When you use the code in this article the validationErrors array will only ever contain the first validation error which Ajv encounters. This is because we are not enabling the Ajv allErrors option, which introduces a security vulnerability.

The difference between error handler middleware and regular middleware is that error handler middleware functions specify four parameters instead of three i.e. (error, request, response, next). To be able to handle the error created by express-json-validator-middleware and send a useful error response back to the client we need to create our own error handler middleware and configure our Express application to use.

const { ValidationError } = require("express-json-validator-middleware");

/**
 * Error handler middleware for handling errors of the
 * `ValidationError` type which are created by
 * `express-json-validator-middleware`. Will pass on
 * any other type of error to be handled by subsequent
 * error handling middleware.
 *
 * @see https://expressjs.com/en/guide/error-handling.html
 *
 * @param {Error} error - Error object
 * @param {Object} request - Express request object
 * @param {Object} response - Express response object
 * @param {Function} next - Express next function
 */
function validationErrorMiddleware(error, request, response, next) {
	/**
	 * If response headers have already been sent,
	 * delegate to the default Express error handler.
	 */
	if (response.headersSent) {
		return next(error);
	}

	/**
	 * If the `error` object is not a `ValidationError` created
	 * by `express-json-validator-middleware`, we'll pass it in
	 * to the `next()` Express function and let any other error
	 * handler middleware take care of it. In our case this is
	 * the only error handler middleware, so any errors which
	 * aren't of the `ValidationError` type will be handled by
	 * the default Express error handler.
	 *
	 * @see https://expressjs.com/en/guide/error-handling.html#the-default-error-handler
	 */
	const isValidationError = error instanceof ValidationError;
	if (!isValidationError) {
		return next(error);
	}

	/**
	 * We'll send a 400 (Bad Request) HTTP status code in the response.
	 * This let's the client know that there was a problem with the
	 * request they sent. They will normally implement some error handling
	 * for this situation.
	 *
	 * We'll also grab the `validationErrors` array from the error object
	 * which `express-json-validator-middleware` created for us and send
	 * it as a JSON formatted response body.
	 *
	 * @see https://httpstatuses.com/400
	 */
	response.status(400).json({
		errors: error.validationErrors,
	});

	next();
}

This allows us to send back error responses like this when there is an error validating the request body against our user schema:

< HTTP/1.1 400 Bad Request
< Content-Type: application/json; charset=utf-8
< Content-Length: 187

{
    "errors": {
        "body": [
            {
                "keyword": "minimum",
                "dataPath": ".age",
                "schemaPath": "#/properties/age/minimum",
                "params": {
                    "comparison": ">=",
                    "limit": 18,
                    "exclusive": false
                },
                "message": "should be >= 18"
            }
        ]
    }
}

Pulling it all together

Here are all of the code snippets in this article combined into a complete Express API application:

const express = require("express");

const {
	Validator,
	ValidationError,
} = require("express-json-validator-middleware");

const { validate } = new Validator();

function validationErrorMiddleware(error, request, response, next) {
	if (response.headersSent) {
		return next(error);
	}

	const isValidationError = error instanceof ValidationError;
	if (!isValidationError) {
		return next(error);
	}

	response.status(400).json({
		errors: error.validationErrors,
	});

	next();
}

const userSchema = {
	type: "object",
	required: ["first_name", "last_name"],
	properties: {
		first_name: {
			type: "string",
			minLength: 1,
		},
		last_name: {
			type: "string",
			minLength: 1,
		},
		age: {
			type: "integer",
			minimum: 18,
		},
	},
};

const app = express();
app.use(express.json());

app.post(
	"/user",
	validate({ body: userSchema }),
	function createUserRouteHandler(request, response, next) {
		response.json(request.body);

		next();
	}
);

app.use(validationErrorMiddleware);

const PORT = process.env.PORT || 3000;

app.listen(PORT, () =>
	console.log(`Example app listening at http://localhost:${PORT}`)
);

Note: For the purpose of this article I’ve combined everything into one block of code, but in a real application I would recommend separating the concerns into separate files. You can read more about this in 5 best practices for building a modern API with Express.

Wrapping things up

You might have guessed from this article that I’m a big fan of JSON Schema. I think that it’s an excellent way to approach request validation, and I hope that you’re now ready to give it a try in your Express based applications.

You can learn how to transform the raw errors array from Ajv into an even more helpful error response in my article Send awesome structured error responses with Express.

Handy JSON Schema links

  • Understanding JSON Schema book – An excellent free online book which will teach you the fundamentals and help you make the most of JSON Schema (also available in PDF format).
  • JSON Schema Specification Links – The latest specifications for JSON Schema.
  • ajv-errors – An Ajv plugin for defining custom error messages in your schemas.
  • fluent-schema – Writing large JSON schemas is sometimes overwhelming, but this powerful little library allows you to write JavaScript to generate them.
Express API Validation Essentials book cover

Overwhelmed trying to implement validation in your Express API?

I’ve written a book that pulls together all of the validation concepts and techniques that I’ve shared through articles here on this blog. It combines them into a complete API validation strategy that you can immediately start applying in your Express applications.

«Concise and a pleasure to read. This book has clarified concepts for me that I couldn’t get right even after years of consulting the Express documentation.»

— Carles Andres, Lead Engineer at Tellimer

The book is packed with practical code examples and includes a handy JSON Schema cheat sheet.

➜ Confidently apply validation best practices today

Introduction

It is imperative to carry out server-side validation when building applications — especially client-facing applications. The reason being, one can never rely on the user’s input alone; as these inputs sometimes contain bogus/malicious data.

Client-side validation is a great way to sift through most of the input, but you still need to perform server-side validation as well.

There are many ways to validate data in Node.js and in this article, we will be taking a look at express-validator. Express-validator is a library which wraps around validator.js and exposes its functions as a set of middlewares.

Project Setup

For this tutorial, we will be building a demo backend server to mock user registration and login with Node.js. These fields will enforce certain rules and we’ll validate the data that comes through.

Please note we will not be handling actual user registration and login logic i.e saving user data and implementing authentication as this is outside the scope of this article.

To get started, we will create a project folder, navigate into it and initialize it:

# Create the project folder
$ mkdir express-validator-tut

# Navigate into the project folder
$ cd express-validator-tut

# Initialize project
$ yarn init -y
# OR
$ npm init -y

When done, we will install the following dependencies by running the command below:

$ yarn add body-parser express express-validator
# OR
$ npm i body-parser express express-validator

Let’s take a look at what we’ve installed:

  • express: A lightweight web application framework for Node.js. We will be using this to handle routing in our backend server.
  • body-parser: A middleware which will help us parse incoming request inputs (user inputs) to the req.body object.
  • express-validator: The library which we will be using to handle incoming input validation.

Lastly, we will create an index.js file in our project directory to host the boilerplate code for the instantiation of an Express application/server:

// index.js
const express = require('express');
const app = express();
const bodyParser = require('body-parser');
const port = 2022;

app.use(bodyParser.urlencoded({ extended: false }));
app.use(bodyParser.json());

app.post('/register', (req, res) => {});
    
app.listen(port);
console.log('See where it all happens at http://localhost:'+port);

Now, let’s run this app with node:

$ node index.js 

If all goes well, your terminal should output something along the lines of:

Standard Validation Rules with express-validator

In this section, we will learn how to add simple validation and sanitisation rules to incoming requests. Firstly, we want to check if the value input into the email field is a valid email or not. Then, we’ll want to enforce that the password contains at least 6 characters.

To get started, let’s add a couple of middleware functions to our /login route:

// index.js
...
const { body, validationResult } = require('express-validator');

app.post('/login',
    body('email').isEmail().normalizeEmail(),
    body('password').isLength({
        min: 6
    }),
    (req, res) => {
        const errors = validationResult(req);

        if (!errors.isEmpty()) {
            return res.status(400).json({
                success: false,
                errors: errors.array()
            });
        }

        res.status(200).json({
            success: true,
            message: 'Login successful',
        })
    });
...

In the snippet above, we are making use of two validator methods:

  • isEmail(): This validator function checks if the incoming string is a valid email address.
  • isLength(): This validator checks if the length of a string falls in a specified range. In our case, the range specified is a minimum of 6 characters.

Some of the other methods we could’ve used are:

  • isNumeric() — Checks if the input is numeric
  • contains() — Checks if the input contains a certain value
  • isBoolean() — Check is the input is a boolean value
  • isCurrency() — Checks if the input is currency-formatted
  • isJSON() — Checks if the input is JSON
  • isMobilePhone() — Checks is the input is a valid mobile phone number
  • isPostalCode() — Checks if the input is a valid postal code
  • isBefore() and isAfter() — Checks if a date is before or after another date

There are others, but these are probably the ones to cover most of your validation needs.

To ensure email addresses supplied by the user is free of noise and irregularities we will add a sanitiser to our email field as seen in the snippet above. The normalizeEmail() method helps to convert the emails entered into the standard approved format. This means if a user enters, for example, [email protected], it will be canonicalised to [email protected].

Validator.js offers some flexibility as this option can be toggled off or on but is set to on by default. There’s a bunch of options for normalization you might want to check out if you’re planning on normalizing the input. If you’d like to read more about other validators/sanitizer functions, you can check out Validator.js’ official documentation.

Let’s test out our code by sending a request with an invalid password, and a @googleemail.com email, using Postman or curl:

Check out our hands-on, practical guide to learning Git, with best-practices, industry-accepted standards, and included cheat sheet. Stop Googling Git commands and actually learn it!

So far, we took a look at how we could validate incoming inputs for a sample login endpoint. Let’s now switch to the registration endpoint and cover tasks like custom validation rules, error messages, schema validation and standardization of validation messages.

Custom Validation Rules and Error Messages with express-validator

To get started, let’s create our user registration endpoint by adding the following snippet to our index.js file:

// index.js
...
app.post('/register', (req, res) => {
    // Validate incoming input
    res.status(200).json({
        success: true,
        message: 'Registration successful',
    });
});
...

custom() Method

To make sure our users input unique usernames during registration, we can’t use the standard methods wrapped from Validator.js methods, since there is no method to check it.

We’ll have to write a custom validator for this, which can be done using the custom() method. The custom() method accepts a function, which can additionally be async. If the function is async, you’ll want to reject the promise if the validation fails, and specify a custom message. If not, you can throw an exception.

Let’s start with rejecting a promise first:

// index.js
...
app.post('/register',
    body("username").custom(value => {
        return User.find({
            username: value
        }).then(user => {
            if (user.length > 0) {
                // Custom error message and reject
                // the promise
                return Promise.reject('Username already in use');
            }
        });
    }),
    (req, res) => {
        // Validate incoming input
        const errors = validationResult(req);
        if (!errors.isEmpty()) {
            return res.status(400).json({
                errors: errors.array()
            });
        }
        ...
    })

In the code snippet above, we are calling the find() method on the User model Mongoose schema to check if the username entered by the client already exists in our database.

If it’s present, we reject the promise with a message we’d like to return back to the user.

Although MongoDB will automatically detect this if the username field was marked unique when specifying the database schema. It’s advisable to handle this before it gets to the DB so our application does not crash prematurely.

Alternatively, you can throw an exception as a way to signify invalid input:

// index.js
...
    
app.post('/register',
        body("username").custom(value => {
            return User.find({
                username: value
            }).then(user => {
                if (user.length > 0) {
                    throw ("Username is taken!"); //custom error message
                }
            });
        }),
...

withMessage() Method

The second way to implement custom validation error messages is by using the withMessage()chain. You can put a number of validators, followed by withMessage() chained methods to specify error messages for each validation:

body("parameter")
    .validator1()
    .withMessage('Message 1')
    .validator2()
    .withMessage('Message 2')

Let’s apply this with actual methods to our example:

// index.js
    
...
app.post('/register',
    body("password").isStrongPassword({
        minLength: 8,
        minLowercase: 1,
        minUppercase: 1,
        minNumbers: 1
    })
    .withMessage("Password must be greater than 8 and contain at least one uppercase letter, one lowercase letter, and one number"),
    (req, res) => {
        // Validate incoming input
    })
...

Let’s make another request, with an invalid password and a username that’s already in use:

Schema Validation with express-validator

Schema validation offers a cleaner approach to validating data. Instead of calling numerous functions, we specify the validation rules for each field and pass the schema into a single middleware function called checkSchema().

In the snippet below, we will be creating a validation schema for user registration endpoint:

// index.js
... 
const {body, checkSchema, validationResult} = require('express-validator');
const registrationSchema = {
    username: {
        custom: {
            options: value => {
                return User.find({
                    username: value
                }).then(user => {
                    if (user.length > 0) {
                        return Promise.reject('Username already in use')
                    }
                })
            }
        }
    },
    gender: {
        notEmpty: true,
        errorMessage: "Gender field cannot be empty"
    },
    password: {
        isStrongPassword: {
            minLength: 8,
            minLowercase: 1,
            minUppercase: 1,
            minNumbers: 1
        },
        errorMessage: "Password must be greater than 8 and contain at least one uppercase letter, one lowercase letter, and one number",
    },
    phone: {
        notEmpty: true,
        errorMessage: "Phone number cannot be empty"
    },
    email: {
        normalizeEmail: true,
        custom: {
            options: value => {
                return User.find({
                    email: value
                }).then(user => {
                    if (user.length > 0) {
                        return Promise.reject('Email address already taken')
                    }
                })
            }
        }
    }
}
...

By specifying a schema, we can drill into specific input fields to apply validators and sanitizers, and it’s much more readable than chaining a lot of methods with validation messages like we’ve seen in the previous sections.

Now, we can go ahead and use this checkSchema() to validate data on registration:

app.post('/signup', checkSchema(registrationSchema), (req, res) => {
    // Validate incoming input
    const errors = validationResult(req);

    if (!errors.isEmpty()) {
        return res.status(400).json({
            errors: errors.array()
        });
    }

    res.status(200).json({
        success: true,
        message: 'Registration successful',
    });
})

If you only need a small amount of validations and want to keep it simple, you can use methods. If you have a huge amount of validations to be done, it’ll be more readable if you use schema validation.

Standardizing Validation Responses with express-validator

express-validator makes it possible to standardise validation error responses. This means you can create your middleware functions to run validations and handle validation errors.

An example of how this can be done is by creating a validate() function which will accept all our validators and run them in parallel using Promise.all():

// index.js
const validate = validations => {
    return async (req, res, next) => {
        await Promise.all(validations.map(validation => validation.run(req)));

        const errors = validationResult(req);
        if (errors.isEmpty()) {
            return next();
        }

        res.status(400).json({
            errors: errors.array()
        });
    };
};

Now our validate function has been created we can re-use it on multiple routes. Let’s apply it to our login and registration routes:

// index.js
...
app.post('/login', validate([
        body('email').isEmail().normalizeEmail(),
        body('password').isLength({
            min: 12
        })
    ]),
    (req, res) => {
        // Process data
        res.status(200).json({
            success: true,
            message: 'Login successful',
        })
    });

app.post('/register', validate(checkSchema(registrationSchema)), (req, res) => {
    // Process data
    res.status(200).json({
        success: true,
        message: 'Registration successful',
    });
});
...

As seen in the snippet above — the use of a custom validation middleware which runs all our validators and sanitizers not only a gives us a performance boost with the Promise.all() call, but we also get to improve code readability. This will prove useful when we need to validate a lot of form fields.

Conclusion

In this article, we’ve gone over the basic and more advanced usage of express-validator, a great lightweight library that wraps around the well-known validator.js library.

Cover image for Schema based validation using express-validator in Node.js

Jayesh Choudhary

When working with Node.js it is very common to receive data in request (body, query, params), and based on that data we perform some operations on DB and return the results.

Since the data will be coming from external resources like Client-side UI (browsers), programs that consume our API, Postman (API testing client) etc. hence we need to make sure that the data we are receiving should be properly validated before passing it to the controller or DB.

In this tutorial, we will be taking a look at the best and easiest way to validate request data using express-validator package

Not validating data can lead to unwanted data, program crashing, malicious hacker attack so it is always recommended to validate data first before doing any operation on it

💡 all the examples included in the tutorial are available on my github repo

Basic Project Setup

In this tutorial, we will be building an express.js app with some API endpoints POST - /api/user and validate incoming req data

# Create the project folder
$ mkdir express-validator-example

# Navigate into the project folder
$ cd express-validator-example

# Initialize project
$ npm init -y

# install express
$ npm install express

Enter fullscreen mode

Exit fullscreen mode

Project structure

we will be following best practice by using modular approach where everything is placed in a different file, this will make our code structured and maintainable

image.png

index.js

const express = require("express");

const app = express();
const PORT = 3000;
const userRouter = require("./routes/user.router");

app.use(express.urlencoded({ extended: true }));
app.use(express.json());

// routes middleware
app.use("/api/user", userRouter);

app.listen(PORT, () => console.log("Server listening on port", PORT));

Enter fullscreen mode

Exit fullscreen mode

routes/user.router.js

const router = require("express").Router();
const UserController = require("../controllers/user.controller");
const { userDataValidate } = require("../validations/user.validation");

router.post("/", userDataValidate, UserController.addUser);

module.exports = router;

Enter fullscreen mode

Exit fullscreen mode

controllers/user.controller.js

const addUser = (req, res, next) => {
  const userData = {
    userName: req.body.userName,
    password: req.body.password,
    email: req.body.email,
  };

  try {
    // save data to DB
    User.create(userData);

    res.json({ success: true });
  } catch (err) {
    next(err);
  }
};

module.exports = { addUser };

Enter fullscreen mode

Exit fullscreen mode

validations/user.validation.js

const userDataValidate = (req, res, next) => {
  // todo
};

module.exports = { userDataValidate };

Enter fullscreen mode

Exit fullscreen mode

Traditional way of data validation

let’s validate user data received by hitting /api/user without using any external libraries

user.validation.js

const userDataValidate = (req, res, next) => {
  if (!req.body.userName) {
    throw Error("username is required");
  }
  if (!req.body.password) {
    throw Error("password is required");
  }
  if (req.body.password.length < 5) {
    throw Error("password should have atleast 5 characters");
  }
  if (!isValidEmail()) {
    throw Error("provide valid email");
  }
  // .... and so on
};

module.exports = { userDataValidate };

Enter fullscreen mode

Exit fullscreen mode

as you can see there are lot of validation if() checks. and if our api had 10-15 keys then the validation function will going to be very long and prone to errors

Introduction to express-validator

According to express-validator docs

express-validator is a set of
express.js middlewares that wraps validator.js validator and sanitizer functions.

express-validator makes data validation very simple and easy to maintain. also it is the most popular choice in node.js for validations

installation

npm install --save express-validator

Enter fullscreen mode

Exit fullscreen mode

Usage

Since each validation rule in express-validator is separate middleware, hence we can pass an array of validation rules to middleware in user.router.js

let’s write user validation of data on various fields

add below code to user.validation.js

const { body } = require("express-validator");

const userDataValidateChainMethod = [
  body("userName")
    .exists({ checkFalsy: true })
    .withMessage("User name is required")
    .isString()
    .withMessage("User name should be string"),
  body("password")
    .exists()
    .withMessage("Password is required")
    .isString()
    .withMessage("Password should be string")
    .isLength({ min: 5 })
    .withMessage("Password should be at least 5 characters"),
  body("email").optional().isEmail().withMessage("Provide valid email"),
  body("gender")
    .optional()
    .isString()
    .withMessage("Gender should be string")
    .isIn(["Male", "Female", "Other"])
    .withMessage("Gender value is invalid"),
  body("dateOfBirth")
    .optional()
    .isDate()
    .withMessage("DOB should be valid date"),
  body("phoneNumber")
    .optional()
    .isString()
    .withMessage("phone number should be string")
    .custom((value) => {
      if (value.length !== 10) {
        return Promise.reject("Phone number should be 10 digits");
      } else {
        return true;
      }
    }),
];

Enter fullscreen mode

Exit fullscreen mode

Explanation:

express-validator provides chainable functions which we add as many validation rules as we want

In the code above we have used below validation middleware

  • body(): this will only validate req.body fields (if you want to validate param, query of request then param(), query() are also available)
    there is also check() available which will search for key in whole req object but only for req.body use body()
  • exists(): for required fields (makes field compulsory to include)
    there is also checkFalsy: true option available which also check if a value should not contain falsy value like «», null, undefined
  • withMessage(): custom message to display when validation fails
  • isString(): checks if value is string
  • isDate(): checks if it is valid date
  • optional(): value is optional
  • isIn(): check if input value contains one of value present in array.
  • isEmail(): checks for valid email id
  • custom(): write a custom validator for your own needs (you can also write async DB lookup validations here)
  • isLength({min: 2, max: 10}): check for min and max characters in value

Other common validator’s

  • isNumeric(): checks if value is number
  • bail(): Stops running validations if any of the previous ones have failed.
  • isMobilePhone(): checks if input is valid phone number

💡 To explore other validator functions refer to validator.js

Now using userDataValidateChainableAPI, your /routes/user.router.js will be like this:

user.router.js

router.post("/", userDataValidateChainMethod, UserController.addUser);

Enter fullscreen mode

Exit fullscreen mode

Error handing

To get the errors from user validation use validationResult() from the express-validator

In the user controller we will check the errors from the validation. if there are any then return all the errors

user.controller.js

const { validationResult } = require("express-validator");

const addUser = (req, res, next) => {
  try {
    const errors = validationResult(req);

    // if there is error then return Error
    if (!errors.isEmpty()) {
      return res.status(400).json({
        success: false,
        errors: errors.array(),
      });
    }

    // save data to DB
    User.create(req.body);

    res.json({ success: true });
  } catch (err) {
    next(err);
  }
};

module.exports = { addUser };

Enter fullscreen mode

Exit fullscreen mode

Error Object

When the POST - /api/user is hit then we will get errors (if we have not provided req.body as required by our schema)

Below is how the error object will look like

{
    "success": false,
    "errors": [
        {
            "value": "tet",
            "msg": "Password should be at least 5 characters",
            "param": "password",
            "location": "body"
        },
        {
            "value": "test.gmail",
            "msg": "Provide valid email",
            "param": "email",
            "location": "body"
        }
    ]
}

Enter fullscreen mode

Exit fullscreen mode

Schama based validation

The chain api for validation provided by express-validator is great but it can also get very hard to read if a single field has many validations. then a single validation middleware will have chain function hell

To solve this problem there is also schema-based validation in express-validator. this offers a clear approach where instead of chaining new function for new validation we have an object with key and values as validation schema at one place.

checkSchema() takes schema object as parameter and will be placed inside our user router middleware

let’s create same validation in schema-based validation

user.validation.js

const userDataValidateSchemaBased = checkSchema({
  userName: {
    exists: {
      errorMessage: "User name is required",
      options: { checkFalsy: true },
    },
    isString: { errorMessage: "User name should be string" },
  },
  password: {
    exists: { errorMessage: "Password is required" },
    isString: { errorMessage: "password should be string" },
    isLength: {
      options: { min: 5 },
      errorMessage: "Password should be at least 5 characters",
    },
  },
  email: {
    isEmail: { errorMessage: "Please provide valid email" },
  },
  gender: {
    isString: { errorMessage: "Gender should be string" },
    isIn: {
      options: [["Male", "Female", "Other"]],
      errorMessage: "Gender is invalid",
    },
  },
  dateOfBirth: {
    isDate: { errorMessage: "DOB should be string" },
  },
  phoneNumber: {
    isString: { errorMessage: "phone number should be string" },
    options: (value) => {
      value.length === 10;
    },
    errorMessage: "Phone number should be 10 digits",
  },
});

Enter fullscreen mode

Exit fullscreen mode

To use schema based object our user.router.js will look like this

checkSchema() is used for schema validation

user.router.js

router.post(
  "/schama-based",
  checkSchema(userDataValidateSchemaBased),
  UserController.addUser
);

Enter fullscreen mode

Exit fullscreen mode

Testing /api/user using Postman

run project using npm run start
postman test

Conclusion

  • successfully used express-validator package to easily validate input for Node.js apps
  • Schema based validation is even faster and convenient
  • Also can sanitize data for improved security

References

[1] Form Data Validation in Node.js with express-validator
[2] How to make input validation simple and clean in your Express.js app

Links

  1. express-validator official docs
  2. validator.js docs
  3. Find all the code examples in my github repo

Buy Me A Coffee

Ошибки есть в каждом коде. Мы перевели гайд разработчика Айо Исайя, в котором он рассказывает о системе ошибок и о том, как их устранять.

Раз вы читаете эту статью, вы, конечно, знакомы с концепцией ошибок в программировании. Это ошибки в коде, они же баги, которые приводят к сбою или неожиданному поведению программы. В отличие от некоторых языков, таких как Go и Rust, где вы вынуждены взаимодействовать с потенциальными ошибками на каждом этапе пути, в JavaScript и Node.js можно обойтись без согласованной стратегии обработки ошибок.

Однако именно такая стратегия делает жизнь проще. Цель статьи — познакомить вас с этими шаблонами для создания, доставки и обработки потенциальных ошибок. Шаблоны помогут обнаружить и обработать потенциальные ошибки в коде до развёртывания.

Что такое ошибки в Node.js

Ошибка в Node.js — это любой экземпляр объекта Error. Общие примеры включают встроенные классы ошибок: ReferenceError, RangeError, TypeError, URIError, EvalError и SyntaxError. Пользовательские ошибки также можно создать путём расширения базового объекта Error, встроенного класса ошибки или другой настраиваемой ошибки. При создании ошибок таким путём нужно передать строку сообщения, описывающую ошибку. К сообщению можно получить доступ через свойство message объекта. Объект Error также содержит свойства name и stack, которые указывают имя ошибки и точку в коде, в которой объект создаётся.

const userError = new TypeError("Something happened!");
console.log(userError.name); // TypeError
console.log(userError.message); // Something happened!
console.log(userError.stack);
/*TypeError: Something happened!
    at Object.<anonymous> (/home/ayo/dev/demo/main.js:2:19)
    <truncated for brevity>
    at node:internal/main/run_main_module:17:47 */

Функции объекта Error можно передать или вернуть из функции. Если бросить его с помощью throw, объект Error станет исключением. Когда вы передаёте ошибку из функции, она переходит вверх по стеку, пока исключение не будет поймано. В противном случае uncaught exception может обвалить всю работу.

Как обработать ошибку

Оптимальный способ обработки ошибок функции JavaScript зависит от того, выполняет ли эта функция синхронную или асинхронную операцию. Рассмотрим четыре общих шаблона, позволяющих обрабатывать ошибки функций в Node.js.

Исключения

Чаще всего ошибки функций обрабатывают путём генерации. В этом случае ошибка становится исключением, после чего её можно поймать где-нибудь в стеке с помощью блока try / catch. Если у ошибки есть разрешение всплывать в стеке, не будучи перехваченной, она преобразуется в формат uncaughtException, что приводит к преждевременному завершению работы приложения. Например, встроенный метод JSON.parse () выдаёт ошибку, если строковый аргумент не является допустимым объектом JSON.

function parseJSON(data) {
  return JSON.parse(data);
}
try {
  const result = parseJSON('A string');
} catch (err) {
  console.log(err.message); // Unexpected token A in JSON at position 0
}

Для использования этого шаблона в функциях нужно добавить ключевое слово throw перед экземпляром ошибки. Этот шаблон сообщения об ошибках и обработки идиоматичен для функций, выполняющих синхронные операции.

function square(num) {
  if (typeof num !== 'number') {
    throw new TypeError(`Expected number but got: ${typeof num}`);
  }
  return num * num;
}
try {
  square('8');
} catch (err) {
  console.log(err.message); // Expected number but got: string
}

Колбэк с первым аргументом-ошибкой

Из-за своей асинхронной природы Node.js интенсивно использует функции колбэка для обработки большей части ошибок. Колбэк (обратный вызов) передаётся в качестве аргумента другой функции и выполняется, когда последняя завершает свою работу.

Node.js использует колбэк с первым аргументом-ошибкой в большинстве асинхронных методов, чтобы гарантировать проверку ошибок до результатов операции. Колбэк обычно является последним аргументом функции, инициирующей асинхронную операцию, и вызывается один раз при возникновении ошибки или получении результата:

function (err, result) {}

Первый аргумент зарезервирован для объекта ошибки. Если ошибка возникает в ходе асинхронной операции, она доступна через аргумент err при неопределённом результате. Однако, если ошибки не возникает, err будет иметь значение null или undefined, а result будет содержать ожидаемый результат операции. Этот шаблон работает, если прочитать содержимое файла с помощью встроенного метода fs.readFile ():

const fs = require('fs');
fs.readFile('/path/to/file.txt', (err, result) => {
  if (err) {
    console.error(err);
    return;
  }
  // Log the file contents if no error
  console.log(result);
});

Метод readFile () использует колбэк в качестве своего последнего аргумента, который, в свою очередь, соответствует подписи функции «первая ошибка». В этом сценарии result включает в себя содержимое файла, который читается, если ошибки не возникает. В противном случае он определяется как undefined, а аргумент err заполняется объектом ошибки, содержащим информацию о проблеме: файл не найден или недостаточно полномочий.

Как правило, методы, использующие колбэк для обработки ошибок, не могут определить, насколько важна выявленная ошибка. Они возвращают ошибку пользователю для обработки. Важно контролировать поток содержимого колбэка, проверять функцию на наличие ошибки, прежде чем пытаться получить доступ к результату операции.

Чтобы использовать шаблон колбэка с первым аргументом-ошибкой в собственных асинхронных функциях, нужно принять функцию в качестве последнего аргумента и вызвать её:

function square(num, callback) {
  if (typeof callback !== 'function') {
    throw new TypeError(`Callback must be a function. Got: ${typeof callback}`);
  }
  // simulate async operation
  setTimeout(() => {
    if (typeof num !== 'number') {
      // if an error occurs, it is passed as the first argument to the callback
      callback(new TypeError(`Expected number but got: ${typeof num}`));
      return;
    }
    const result = num * num;
    // callback is invoked after the operation completes with the result
    callback(null, result);
  }, 100);
}

Любой вызывающий функцию square должен пройти через колбэк, чтобы получить доступ к нужному результату или ошибке.

Не нужно непосредственно обрабатывать ошибку в функции колбэка. Её можно распространить вверх по стеку, передав на другой колбэк. Но сначала убедитесь, что вы не генерируете исключение внутри функции. Асинхронное исключение невозможно отследить, потому что окружающий блок try / catch завершается до выполнения колбэка. Следовательно, исключение будет распространяться на вершину стека, что приведёт к завершению работы приложения. Исключение — когда обработчик зарегистрирован для process.on ('uncaughtException').

try {
  square('8', (err, result) => {
    if (err) {
      throw err; // not recommended
    }
    console.log(result);
  });
} catch (err) {
  // This won't work
  console.error("Caught error: ", err);
}

Отклонение обещаний

Обещания в JavaScript — это актуальный способ выполнения асинхронных операций в Node.js. Они предпочтительнее колбэков из-за лучшего потока, который соответствует современным способам анализа программ, особенно с шаблоном async / await. Любой API-интерфейс Node.js, использующий колбэки с ошибкой для асинхронной обработки ошибок, может быть преобразован в обещания с помощью встроенного метода util.promisify (). Например, заставить метод fs.readFile () использовать обещания можно так:

const fs = require('fs');
const util = require('util');
const readFile = util.promisify(fs.readFile);

Переменная readFile — это версия fs.readFile () с обещаниями, в которой отклонения обещаний используются для сообщения об ошибках. Эти ошибки можно отследить, связав метод catch:

readFile('/path/to/file.txt')
  .then((result) => console.log(result))
  .catch((err) => console.error(err));

Также можно использовать обещанные API в функциях async. Так выглядит основной способ использования обещаний в современном JavaScript: в нём код читается как синхронный, и для обработки ошибок применяют знакомый механизм try / catch. Перед асинхронным запуском важно использовать await, чтобы обещание было выполнено или отклонено до того, как функция возобновит выполнение. При отклонении обещания выражение await выбрасывает отклонённое значение, которое впоследствии попадает в окружающий блок catch.

(async function callReadFile() {
  try {
    const result = await readFile('/path/to/file.txt');
    console.log(result);
  } catch (err) {
    console.error(err);
  }
})();

Обещанияможно использовать в асинхронных функциях, возвращая обещание из функции и помещая код функции в обратный вызов обещания. Если есть ошибка, её стоит отклонить (reject) с помощью объекта Error. В противном случае можно разрешить (resolve) обещание с результатом, чтобы оно было доступно в цепочке метода .then или напрямую как значение функции async при использовании async / await.

function square(num) {
  return new Promise((resolve, reject) => {
    setTimeout(() => {
      if (typeof num !== 'number') {
        reject(new TypeError(`Expected number but got: ${typeof num}`));
      }
      const result = num * num;
      resolve(result);
    }, 100);
  });
}
square('8')
  .then((result) => console.log(result))
  .catch((err) => console.error(err));

Источники событий

Другой шаблон, подходящий для работы с длительными асинхронными операциями, которые могут приводить к множественным ошибкам или результатам, — это возврат EventEmitter из функции и выдача события как для успешного, так и для неудачного случая:

const { EventEmitter } = require('events');
function emitCount() {
  const emitter = new EventEmitter();
  let count = 0;
  // Async operation
  const interval = setInterval(() => {
    count++;
    if (count % 4 == 0) {
      emitter.emit(
        'error',
        new Error(`Something went wrong on count: ${count}`)
      );
      return;
    }
    emitter.emit('success', count);
    if (count === 10) {
      clearInterval(interval);
      emitter.emit('end');
    }
  }, 1000);
  return emitter;
}

Функция emitCount () возвращает новый эмиттер событий, который сообщает об успешном исходе в асинхронной операции. Она увеличивает значение переменной count и каждую секунду генерирует событие успеха и событие ошибки, если значение count делится на 4. Когда count достигает 10, генерируется событие завершения. Этот шаблон позволяет передавать результаты по мере их поступления вместо ожидания завершения всей операции.

Вот как можно отслеживать и реагировать на каждое из событий, генерируемых функцией emitCount ():

const counter = emitCount();
counter.on('success', (count) => {
  console.log(`Count is: ${count}`);
});
counter.on('error', (err) => {
  console.error(err.message);
});
counter.on('end', () => {
  console.info('Counter has ended');
});

Функция колбэка для каждого прослушивателя событий выполняется независимо, как только событие генерируется. Событие ошибки (error) — это особый случай для Node.js, потому что при отсутствии прослушивателя процесс Node.js выходит из строя. Вы можете закомментировать прослушиватель событий ошибки выше и запустить программу, чтобы увидеть, что произойдёт.

Расширение объекта ошибки

Необходимо создавать собственные пользовательские классы ошибок, чтобы лучше отражать разные типы ошибок: класс ValidationError для ошибок, возникающих при проверке пользовательского ввода, класс DatabaseError для операций с базами данных, TimeoutError для операций, для которых истекло назначенное им время ожидания.

Пользовательские классы ошибок, расширяющие объект Error, сохранят основные свойства ошибки: сообщение (message), имя (name) и стек (stack). Но у них есть собственные свойства. ValidationError можно улучшить, добавив значимые свойства — часть ввода, вызвавшую ошибку.

Вот как можно расширить встроенный объект Error в Node.js:

class ApplicationError extends Error {
  constructor(message) {
    super(message);
    // name is set to the name of the class
    this.name = this.constructor.name;
  }
}
class ValidationError extends ApplicationError {
  constructor(message, cause) {
    super(message);
    this.cause = cause
  }
}

Класс ApplicationError — общая ошибка, а класс ValidationError представляет любую ошибку, возникающую при проверке ввода данных пользователем. Он наследуется от класса ApplicationError и дополняет его свойством cause для указания ввода, вызвавшего ошибку. Пользовательские классы ошибки можно использовать, как и обычные:

function validateInput(input) {
  if (!input) {
    throw new ValidationError('Only truthy inputs allowed', input);
  }
  return input;
}
try {
  validateInput(userJson);
} catch (err) {
  if (err instanceof ValidationError) {
    console.error(`Validation error: ${err.message}, caused by: ${err.cause}`);
    return;
  }
  console.error(`Other error: ${err.message}`);
}

Ключевое слово instanceof следует использовать для проверки конкретного типа ошибки. Не используйте имя ошибки для проверки типа, как в err.name === 'ValidationError': это не сработает, если ошибка получена из подкласса ValidationError.

Типы ошибок

Типы ошибок можно разделить на две основные категории: ошибки программиста и операционные проблемы. К первому типу можно отнести неудачные или неправильные аргументы функции, в то время как временные сбои при работе с внешними API однозначно относятся ко второй категории.

Операционные ошибки

Операционные ошибки — это предсказуемые ошибки, которые возникают в процессе выполнения приложения. Это не обязательно баги, чаще это даже внешние обстоятельства, способные нарушить ход выполнения программы. В таких случаях можно полностью понять влияние ошибки на процессы:

  • Запрос API не выполняется по какой-либо причине (например, сервер не работает или превышен лимит скорости).

  • Соединение с базой данных потеряно, например, из-за неисправного сетевого соединения.

  • ОС не может выполнить запрос на открытие файла или запись в него.

  • Пользователь отправляет на сервер недопустимые данные: неверный номер телефона или адрес электронной почты.

Ошибки программиста

Ошибки программиста — это ошибки в логике или синтаксисе программы, которые можно исправить только путём изменения исходного кода. Ошибки этого типа невозможно обработать, потому что это недочёты в программе:

  • Синтаксические ошибки: незакрытая фигурная скобка.

  • Ошибки типа при попытке сделать что-то неправильное: выполнение операций с операндами несовпадающих типов.

  • Неверные параметры при вызове функции.

  • Ссылки на ошибки при неправильном написании имени переменной, функции или свойства.

  • Попытка получить доступ к местоположению за концом массива.

  • Неспособность обработать операционную ошибку.

Обработка операционных ошибок

Операционные ошибки в большинстве случаев предсказуемы. Их обработка — это рассмотрение вероятности неудачного завершения операции, возможных причин и последствий. Рассмотрим несколько стратегий обработки операционных ошибок в Node.js.

Сообщить об ошибке в стек

Во многих случаях лучше остановить выполнение программы, очистить все незавершённые процессы и сообщить об ошибке в стек. Зачастую это единственный способ исправить ошибку, когда функция, в которой она возникла, находится дальше по стеку. 

Повторить операцию

Сетевые запросы к внешним службам иногда могут завершаться ошибкой, даже если запрос полностью верен. Это случается из-за сбоя и неполадках сети или перегрузке сервера. Можно повторить запрос несколько раз, пока он не будет успешно завершён или пока не будет достигнуто максимальное количество повторных попыток. Первое, что нужно сделать, — это определить, уместно ли повторить запрос. Если исходный код состояния HTTP ответа — 500, 503 или 429, повторте запрос через некоторое время.

Проверьте, присутствует ли в ответе HTTP-заголовок Retry-After. Он указывает на точное время ожидания перед выполнением последующего запроса. Если его нет, необходимо отложить последующий запрос и постепенно увеличивать временной промежуток для каждой повторной попытки. Этот метод известен как стратегия экспоненциального отката. Нужно ещё определить максимальное время задержки и число запросов до отказа от дальнейших попыток.

Отправить ошибку клиенту

По умолчанию пользователи вводят данные неправильно. Поэтому первое, что нужно сделать перед запуском каких-либо процессов, — проверить введённые данные и незамедлительно сообщить пользователю о любых ошибках. При обработке ошибок клиента обязательно включите всю информацию, необходимую для создания сообщения об ошибке и имеющую смысл для пользователя.

Прервать программу.

В случае неисправимых системных ошибок разумный выход — зарегистрировать ошибку и немедленно завершить работу программы. Если исключение невозможно исправить на уровне JavaScript, то, возможно, не получится корректно завершить работу сервера. Тогда нужен системный администратор, способный всё исправить.

Предотвращение ошибок программиста

Ошибки программиста сами по себе не могут быть обработаны, потому что их причина в коде или в логике. Однако ошибаться можно реже.

Принять TypeScript

TypeScript — это строго типизированное надмножество JavaScript. Основная цель его проектирования — статическая идентификация потенциально ошибочных конструкций без штрафных санкций во время выполнения. Принимая TypeScript в проекте (с максимально возможными параметрами компилятора), можно устранить целый класс ошибок программиста в ходе компиляции.

Когда проект на TypeScript, такие ошибки, как undefined is not a function, синтаксические или ссылочные ошибки, исчезают из кодовой базы. Перенос на TypeScript можно выполнять постепенно. Для быстрой миграции есть инструмент ts-migrate.

Определить поведение для неверных параметров

Многие ошибки возникают из-за передачи неверных параметров. Это может быть связано не только с очевидными ошибками, такими как передача строки вместо числа, но и с небольшими погрешностями, когда аргумент функции имеет правильный тип, но выходит за пределы диапазона, который функция способна обработать. Когда функция вызывается таким образом, она может выдать неверное значение, например NaN. Когда сбой обнаруживается, сперва трудно определить его причину.

При работе с неверными параметрами и определяйте их поведение, либо выдавая ошибку, либо возвращая специальное значение, такое как null, undefined или -1, когда проблема может быть решена локально. Первый вариант— это подход, используемый JSON.parse (), который выдаёт исключение SyntaxError, если строка для синтаксического анализа недействительна. Второй вариант — метод string.indexOf ()

Автоматизированное тестирование

Автоматизированные наборы тестов повышает вероятность исправления ошибок. Тесты помогают выяснить, как функция работает с нетипичными значениями. Для модульного тестирования подходят среды, такие как Jest или Mocha.

Неперехваченные исключения и необработанные отклонения обещаний

Неперехваченные исключения и необработанные отклонения обещаний вызываются ошибками программиста. Событие uncaughtException генерируется, когда исключение не перехватывается до того как достигнет цикла обработки событий. При обнаружении неперехваченного исключения приложение немедленно выходит из строя. Для переопределения такого поведения всегда можно добавить обработчик события:

// unsafe
process.on('uncaughtException', (err) => {
  console.error(err);
});

Но неперехваченное исключение указывает на то, что приложение находится в неопределённом состоянии. Поэтому попытка возобновить работу в обычном режиме без восстановления после ошибки небезопасна и может привести к утечке памяти и зависанию сокетов. Лучше использовать обработчик uncaught Exception для очистки всех выделенных ресурсов, закрытия соединений и ведения лога ошибок для оценки перед завершением процесса.

// better
process.on('uncaughtException', (err) => {
  Honeybadger.notify(error); // log the error in a permanent storage
  // attempt a gracefully shutdown
  server.close(() => {
    process.exit(1); // then exit
  });
  // If a graceful shutdown is not achieved after 1 second,
  // shut down the process completely
  setTimeout(() => {
    process.abort(); // exit immediately and generate a core dump file
  }, 1000).unref()
});

Событие unhandledRejection генерируется, когда отклонённое обещание не обрабатывается блоком catch. В отличие от uncaughtException, эти события не вызывают немедленного сбоя приложения. Однако необработанные отклонения обещаний сейчас признаны устаревшими и могут немедленно завершить процесс в следующих релизах Node.js. Отслеживать необработанные отклонения обещаний можно с помощью прослушивателя событий unhandledRejection:

process.on('unhandledRejection', (reason, promise) => {
  Honeybadger.notify({
    message: 'Unhandled promise rejection',
    params: {
      promise,
      reason,
    },
  });
  server.close(() => {
    process.exit(1);
  });
  setTimeout(() => {
    process.abort();
  }, 1000).unref()
});

Серверы необходимо запускать с помощью диспетчера процессов, который автоматически перезапустит их в случае сбоя. Распространённый вариант — PM2, но для Linux существуют также systemd и upstart, а пользователи Docker могут использовать собственную политику перезапуска. По завершении всех процессов стабильное обслуживание будет восстановлено почти мгновенно, а у вас будт информация о неперехваченном исключении. Можно запутсить несколько процессов и применить балансировщик нагрузки для распределения входящих запросов. Это поможет предотвратить простои.

Централизованная отчётность об ошибках

Ни одна стратегия обработки ошибок не будет полной без надёжной стратегии ведения журнала ошибок. Когда происходит сбой, важно узаписать как можно больше информации о проблеме. Централизация логов позволяет оценить, что происходит в коде. 

Honeybadger предоставляет всё необходимое для отслеживания ошибок. Интегрируется так:

Установите пакет

Используйте npm для установки пакета:

$ npm install @honeybadger-io/js --save

Импортируйте библиотеку

Импортируйте библиотеку и настройте её с помощью ключа API, чтобы получать сообщения об ошибках:

const Honeybadger = require('@honeybadger-io/js');
Honeybadger.configure({
  apiKey: '[ YOUR API KEY HERE ]'
});
Сообщите об ошибках
Метоодом notify ():
try {
  // ...error producing code
} catch(error) {
  Honeybadger.notify(error);
}

Просмотрите полную документацию или ознакомьтесь с образцом Node.js / Express на GitHub.


Без обработки ошибок не бывает надёжного софта. 

Спасибо за внимание и удачного кода!

Editor’s note: This article was last updated on 6 July 2022 to bring it up to date with the most recent version of Node.js.

Introduction

Building backend APIs comes with many hassles, one of which is user input validation. It’s important to add an extra layer of validation to incoming data because you can never rely on the users’ input alone.

There are many ways of carrying out input validation in Node.js, but in this article, we will talk about validatorjs, a validation library inspired by the Laravel framework’s validator.

The validatorjs library simplifies data validation in JavaScript. From the official site, some of the advantages of validatorjs are:

  • Ability to work in both the browser and Node
  • Readable and declarative validation rules
  • Error messages with multilingual support
  • CommonJS/Browserify support
  • ES6 support

Contents

  • Installation
  • Basic validation with validatorjs
  • Advanced validation rules with validatorjs

Installation

Let’s launch the following commands to initialize the project directory:

// clone starter application
git clone -b validation-starter https://github.com/lawrenceagles/validatorjs-example

// Enter app folder and install packages
cd validatorjs-example && npm install

In the code above, we installed the following dependencies:

  • Express, a lightweight Node web framework for spinning up RESTful APIs. We will use this to handle routing in our backend API
  • body-parser, a middleware to parse incoming request inputs into our req.body object
  • mongoose, an object modeling tool for MongoDB. This will help create and query our User schema
  • morgan, an HTTP request logger middleware for Node. This will help us debug our API while in development
  • validatorjs
  • Bcryptjs

We also, installed Nodemon as a dev dependency.

Basic validation with validatorjs

Here, we will learn how to carry out basic input validation in a Node project.

The validatorjs package gives us a Validator constructor function with the following signature:

let validation = new Validator(data, rules [, customErrorMessages]);

In the code above, the Validator constructor has three arguments:

  • data, an object that contains the data you want to validate
  • rules, an object that contains the validation rules
  • customErrorMessages, an object that contains the custom error messages to return (this argument is optional)

To work with validatorjs, we will write a simple validation middleware to validate user inputs on signup. To do this, start the MongoDB driver in your system and start the app’s dev server by running:

npm run dev

The application boilerplate comes with a simple endpoint that you can test. With the server running, run a GET request on http://localhost:7000/api/ using your favorite API client.

simple validation middleware on startup

Now, update the validate.js file inside the helper folder as seen below:

const Validator = require('validatorjs');
const validator = async (body, rules, customMessages, callback) => {
    const validation = new Validator(body, rules, customMessages);
    validation.passes(() => callback(null, true));
    validation.fails(() => callback(validation.errors, false));
};
module.exports = validator;

The snippet above shows how to initialize the validatorjs package in AMD format. This method simplifies our code when writing multiple validation middlewares.

Now update validation middleware. The validation-middleware.js file inside the middleware folder should look like this:

const validator = require('../helpers/validate');
const signup = async (req, res, next) => {
    const validationRule = {
        "email": "required|string|email",
        "username": "required|string",
        "phone": "required|string",
        "password": "required|string|min:6|confirmed",
        "gender": "string"
    };

    await validator(req.body, validationRule, {}, (err, status) => {
        if (!status) {
            res.status(412)
                .send({
                    success: false,
                    message: 'Validation failed',
                    data: err
                });
        } else {
            next();
        }
    }).catch( err => console.log(err))
}
module.exports = {
    signup
};

In the snippet above, we defined a signup function that contains our validation rules and the validator higher order function that extends the validator constructor. This validator higher order function accepts four arguments:

  • The data to be validated
  • The validation rule
  • The custom error messages (if any)
  • A callback method.

To apply validation rules to our request body (req.body), object key names have to be the same. For instance, the email fields validation rule will look something like this:

"email": "required|email"

Let’s go over some of the validation rules used in the snippet above and what they mean:

  • required means the field must have a length greater than zero
  • string means the said field must be a string
  • email means the field under validation must be in an email format (e.g., [email protected])
  • min:6 means the said field string length must be greater than or equal to six
  • confirmed means the field under validation must have a matching field foo_confirmation with matching values, commonly used for password confirmation fields

Now that we know our validation rules and what they mean, update the signup method in the baseController.js file as seen below:

// src/controllers/base-controller.js
const { User } = require("../models");

module.exports = {
 ...
    signup: async (req, res) => {
        const { email, gender, username, password, phone } = req.body;
        const newUser = new User({ email, gender, username, password, phone });
        try {
            await newUser.save();
            return res.status(201).json({
                success: true,
                message: "signup successful",
                data: newUser
            });
        } catch (error) {
            return res.status(412).send({
                success: false,
                message: error.message
            })
        }
    }

The snippet above handles signup by creating and saving a new user in the MongoDB database. And the signup method only executes if the req.body object passes validation.

A successful request can be seen below:

successful request

And a failed request can be seen below:

failed request

Note the endpoint queried above is http://localhost:7000/api/signup and it is a POST request.

Advanced validation rules with validatorjs

In this section, we will learn how to write custom validation rules for these use cases:

  1. Implementing strict password policies
  2. The email/username attribute already exists in the database

To get started with the first use case, we will update the validate.js file as seen below:

// src/helpers/validate.js
const Validator = require('validatorjs');
...
const passwordRegex = /^(?=.*[a-z])(?=.*[A-Z])(?=.*d)[a-zA-Zd]/;

// Tighten password policy
Validator.register('strict', value => passwordRegex.test(value),
    'password must contain at least one uppercase letter, one lowercase letter and one number');

module.exports = validator;

This snippet above uses regex to validate incoming values for an input field with the strict validation rule.

Update the validationRule object as seen below:

// src/middleware/validation-middleware.js
     ...
    const validationRule = {
            "email": "required|email",
            "username": "required|string",
            "phone": "required|string",
            "password": "required|string|min:6|confirmed|strict",
            "gender": "string"
    }
     ...

A sample request and response for a failed validation will look something like this:

request and response for a failed validation

For the second use case, where we want to check if the email or username attribute already exists, we’ll make an asynchronous call to our database to check our database and return an error accordingly.

We will use Validator.registerAsync(), that will enable us to make a non-blocking call to our database and also validate other fields simultaneously.

To this, first import the Models into the validate.js file with this code:

const Models = require("../models");

Then update the validate.js file as seen below:

// src/helpers/validate.js
const Validator = require('validatorjs');
const Models = require("../models");
...

/**
 * Checks if incoming value already exist for unique and non-unique fields in the database
 * e.g email: required|email|exists:User,email
 */
Validator.registerAsync('exist', function(value,  attribute, req, passes) {
    if (!attribute) throw new Error('Specify Requirements i.e fieldName: exist:table,column');
    //split table and column
    let attArr = attribute.split(",");
    if (attArr.length !== 2) throw new Error(`Invalid format for validation rule on ${attribute}`);

    //assign array index 0 and 1 to table and column respectively
    const { 0: table, 1: column } = attArr;
    //define custom error message
    let msg = (column == "username") ? `${column} has already been taken `: `${column} already in use`
    //check if incoming value already exists in the database
    Models[table].valueExists({ [column]: value })
    .then((result) => {
        if(result){
            passes(false, msg); // return false if value exists
            return;
        }
        passes();
    })
});

module.exports = validator;

The snippet above accepts table and column names as attributes and uses these values to query the database for values already existing in the specified table and column.

Now, let’s update the validation rule in the signup validation middleware as seen below:

// src/middleware/validation-middleware.js
...

const validationRule = {
        "email": "required|email|exist:User,email",
        "username": "required|string|exist:User,username",
        "phone": "required|string",
        "password": "required|string|min:6|confirmed|strict",
        "gender": "string"
}

...

The snippet above checks if the values for email and username already exist in the database. And a sample failed request is shown in the image below:

sample failed request

Conclusion

In this tutorial, we have learned how to put basic input validation in place with validatorjs. We also learned how to define custom validation rules for two use cases. Validatorjs has more predefined rules than covered in this tutorial. You can learn more here.

The source code for this tutorial is available on GitHub as well. Feel free to clone it, fork it, or submit an issue.

200’s only Monitor failed and slow network requests in production

Deploying a Node-based web app or website is the easy part. Making sure your Node instance continues to serve resources to your app is where things get tougher. If you’re interested in ensuring requests to the backend or third party services are successful, try LogRocket. LogRocket Network Request Monitoringhttps://logrocket.com/signup/

LogRocket is like a DVR for web and mobile apps, recording literally everything that happens while a user interacts with your app. Instead of guessing why problems happen, you can aggregate and report on problematic network requests to quickly understand the root cause.

LogRocket instruments your app to record baseline performance timings such as page load time, time to first byte, slow network requests, and also logs Redux, NgRx, and Vuex actions/state. Start monitoring for free.

Понравилась статья? Поделить с друзьями:

Читайте также:

  • Node js route error
  • Node js pipe error
  • Node js network error
  • Node js http error
  • Node js fetch error

  • 0 0 голоса
    Рейтинг статьи
    Подписаться
    Уведомить о
    guest

    0 комментариев
    Старые
    Новые Популярные
    Межтекстовые Отзывы
    Посмотреть все комментарии