Request bodies and query parameters validated against a schema

Unvalidated API input is the foundation of injection attacks, mass assignment vulnerabilities, and type confusion bugs. OWASP API Security Top 10 2023 API6 (Unrestricted Access to Sensitive Business Flows) and API10 (Unsafe Consumption of APIs) both require that input arrives in the expected shape and type. CWE-20 (Improper Input Validation) is behind SQL injection, XSS, command injection, and business logic bypasses. When an endpoint accepts arbitrary JSON and passes it to a database call or business function, attackers supply crafted payloads — extra fields, wrong types, boundary values — to trigger unintended behavior. Schema validation is the first defense that makes all downstream trust explicit.

Parse every incoming request body and query string through a Zod schema before touching the data. Return 400 with structured errors on failure so callers get actionable feedback.

// src/app/api/posts/route.ts
import { z } from 'zod'

const createPostSchema = z.object({
  title: z.string().min(1).max(200),
  body: z.string().min(1).max(10_000),
  published: z.boolean().default(false)
})

export async function POST(req: Request) {
  const parsed = createPostSchema.safeParse(await req.json())
  if (!parsed.success) {
    return Response.json({ errors: parsed.error.flatten() }, { status: 400 })
  }

  const post = await db.post.create({ data: { ...parsed.data, authorId: user.id } })
  return Response.json(post, { status: 201 })
}

Include query parameter schemas too — z.object({ page: z.coerce.number().min(1) }).parse(Object.fromEntries(url.searchParams)).