Input Validation

Overview

Never trust input. Validate everything at system boundaries.

All external data is potentially malicious or malformed. Validate at the point of entry, fail fast on invalid input.

When to Use

• Handling HTTP request bodies, params, headers
• Reading files or environment variables
• Accepting data from external APIs
• Any function that receives untrusted input

The Iron Rule