Mutating routes validate input before processing

A POST handler that pipes req.body directly into prisma.user.create({ data: body }) accepts whatever JSON the client sends — extra fields, injected relations, overridden IDs. CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) and OWASP A03 describe this exactly: an attacker can escalate privileges by setting role: 'admin' or inject unexpected columns. TypeScript types don't run at runtime; only an explicit .parse() call rejects malformed or malicious input before the write commits.

Validate the request body before any database write. The validation must appear above the first prisma.* call in the handler's execution path.

import { z } from 'zod'

const Body = z.object({
  email: z.string().email(),
  name: z.string().min(1).max(100),
})

export async function POST(req: Request) {
  const body = await req.json()
  const data = Body.parse(body)  // unknown fields stripped; invalid shapes rejected
  const user = await prisma.user.create({ data })
  return Response.json(user, { status: 201 })
}

If you're using tRPC, the .input() call handles this. For Server Actions with next-safe-action, the schema option covers it. The key invariant: no path through the handler should reach a DB write without first passing through a schema parse.