Error messages specify exact requirement
Why it matters
A validation error that says "Invalid input" tells the user nothing about what to change. In a financial form, that friction causes abandonment — and for accessibility, WCAG 2.2 SC 3.3.1 (Error Identification) and SC 3.3.3 (Error Suggestion) require that errors both identify what is wrong and suggest a correction. "Amount must be between $0.01 and $9,999.99" passes both; "Validation failed" fails both. Generic messages also force users to guess which constraint was violated, producing support tickets that cost real money.
Severity rationale
Info because generic error messages degrade UX and violate WCAG 2.2 SC 3.3.1 and 3.3.3 but do not directly expose data or enable exploitation.
Remediation
Define explicit, constraint-naming error strings for every financial validation rule in src/lib/validationErrors.ts or inline in the Zod schema.
// src/lib/schemas.ts
export const transferSchema = z.object({
amountCents: z.number()
.int('Amount must be a whole number of cents')
.min(1, 'Minimum transaction is $0.01')
.max(99999, 'Maximum transaction is $999.99'),
routingNumber: z.string()
.regex(/^\d{9}$/, 'Routing number must be exactly 9 digits')
.refine(isValidABARoutingNumber, 'Invalid routing number — checksum failed'),
});
Return the Zod issues[0].message string directly in the API error response so the client can display it verbatim without mapping.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Financial Form Validation Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- wcag:2.2 · 3.3.1 — Error Identification
- wcag:2.2 · 3.3.3 — Error Suggestion
Taxons
History
- 2026-04-18·v1.0.0·Initial import from finserv-form-validation·automated