Server validation checks submitted input after it reaches the server and before application processing. It remains the source of truth because client-side checks can be bypassed or manipulated. Apply it to every client request, including requests sent to public endpoints. section 9.1.1
A production validation flow should:
- Treat all client-provided data as tamperable, even when the browser already validates it. section 9.1.1
- Validate request data before invoking application or model-processing logic. section 9.1.1
- Use client validation for immediate feedback, but never as the only protection. section 9.1.1
Validate a Next.js API request with Zod
Define a schema requiring a nonempty prompt of no more than 1,000 characters. Parse the request body, process only the validated prompt, and return validation details with status 400 when parsing fails.
