The answer
Because you cannot trust the request body. Missing fields or bad types can crash the server or cause data corruption. Validate early with a library like zod or express-validator.
Common Mistakes When Starting a Node.js Project (and How to Avoid Them)
Why add input validation in a Node.js backend?
More FAQs in Common Mistakes When Starting a Node.js Project (and How to Avoid Them)
No plan, no folder structure, secrets in code, no input validation, no error handling, plain-text passwords, JWT in LocalStorage, no health check, blocking the event loop, and no logging.
In environment variables loaded with dotenv. Keep secrets in a .env file and add .env to .gitignore. Never hardcode secrets in source files.
In an httpOnly, secure, sameSite cookie. LocalStorage is open to XSS and is risky. Cookies configured correctly are safer.
Still have questions?
Browse all our FAQs or reach out to our support team
Want to upskill yourself?
Your learning library
Small steps. Big possibilities.
Find your next course. Build something great.