Input Validation & Sanitization

Summary

Rejecting or cleaning malformed, unexpected, or malicious input before it reaches your business logic or database — the single most effective general-purpose security practice.

• 1Add strict validation (type, length, format) to every field of a public endpoint.
• 2Reject unexpected extra fields in a request body rather than silently ignoring them.
• 3Validate on the server even if the client also validates — never trust the client.