Implementing Request Validation

1. Validating Request Headers

CheckExample
Required presentAuthorization missing → 401
Format regexX-Request-ID = UUID
Allowed valuesAccept: application/json
Max lengthHeader > 8KB → 431

2. Validating Request Body Schema

Example: JSON schema validation

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "required": ["email", "age"],
  "properties": {
    "email": { "type": "string", "format": "email" },
    "age":   { "type": "integer", "minimum": 0, "maximum": 150 }
  },
  "additionalProperties": false
}

3. Using OpenAPI Validation

ToolUse
Kong oas-validationSpec-driven validation
Envoy json_to_metadataBody extraction
AWS APIGW modelRequest validators
Spectral lintCI-time spec quality

4. Validating Query Parameters

Example: Query validator

parameters:
  - name: page
    in: query
    schema: { type: integer, minimum: 1, maximum: 1000, default: 1 }
  - name: sort
    in: query
    schema: { type: string, enum: [asc, desc] }

5. Validating Path Parameters

ParamRule
:idUUID v4 regex
:slug^[a-z0-9-]{1,64}$
:year1900–2100 integer
:localeBCP-47 (en-US)

6. Implementing Content-Type Validation

EndpointAllowed Content-Type
JSON APIapplication/json
Uploadmultipart/form-data
Form POSTapplication/x-www-form-urlencoded
gRPCapplication/grpc

7. Setting Request Size Validation

Endpoint TypeRecommended Max
JSON API256KB - 1MB
File upload50MB - 5GB
GraphQL query16KB
Webhook1MB

8. Using Custom Validation Rules

Example: Custom Lua validator (Kong)

local body, err = kong.request.get_body()
if not body or not body.amount or body.amount <= 0 then
  return kong.response.exit(400, {
    error = "amount must be positive",
    code = "INVALID_AMOUNT"
  })
end

9. Setting Up Sanitization Rules

AttackSanitization
SQL injectionReject ;--, parametrize at app
XSSStrip <script>, encode output
Path traversalBlock ../ in path
Header injectionReject \r\n in headers
LDAP injectionEscape (), *, \

10. Configuring Validation Error Responses

Example: RFC 7807 Problem Details

{
  "type": "https://api.example.com/errors/validation",
  "title": "Validation Failed",
  "status": 400,
  "detail": "Request body failed schema validation",
  "instance": "/v1/users",
  "errors": [
    { "field": "email", "code": "invalid_format" },
    { "field": "age",   "code": "out_of_range" }
  ]
}