Now that we have learned about the importance of validation and the flexibility of joi, let's look at where we can apply it in our hapi applications. Fortunately, hapi provides first class support for validation on its route configuration objects. We saw this very briefly in Chapter 2, Adding Functionality by Routing Requests, both on a route configuration object and where the validation steps take place within the request life cycle.

On a route configuration object, we can provide validation rules through a validate object. With this, we can define specific validation rules for the request headers, parameters, query, payload, and also on the response. It might not be immediately obvious why we would validate our response, but we'll look at that further on in the chapter. Let's first look at an example of a route configuration with added validation rules.

Let's take our user store application from the previous chapters, and add some validation. If you remember the GET route, we asked the user to provide a string userId to retrieve a user, but in our handler, never actually verified that it existed. Let's fix this now by modifying this particular route configuration to add validation rules for ensuring that the userId is a string, it exists, and is of the right length. Let's see what that looks like now (with code removed for brevity):

…
server.route({
  method: 'GET',
  path: '/user/{userId}',
  config: {
    validate: {
      headers: true,
      params: {
        userId: Joi.string().min(4).max(40).required()
      },
      query: false
    },
    handler: function (request, reply) {
      // handler logic
    },
    description: 'Retrieve a user'
  }
});
…

So, as you can see, it's not too complicated to add validation to our routes in a very readable manner. Let's look more closely at the validate property that we added:

…
validate: {
  headers: true,
  params: {
    userId: Joi.string().min(4).max(40).required()
  },
  query: false
},
…

We've added three keys to our verification object, so let's go through each of those and examine what they do. Before explaining each, it's worth noting that for each key that we add to the validate object, the following values are supported:

If validation fails on any of these properties, a Boom.badRequest() error will be returned to the client, and the request life cycle will never reach the handler.

Now let's go through each of the properties from the preceding example. First, we have specified validation for headers, indicating that any value is allowed by specifying true. If this is ever set to false for headers, it will cause all valid HTTP requests to fail. Adding headers: true is not required; by not adding a value for the headers property, it defaults to true. I have only added it here, so as to show that we can add validation rules to request headers.

For our params, we've supplied a joi object that specifies that one segment is allowed, which is the userId segment of our params. The rules applied are that the userId segment supplied in the request must be of minimum length 4 and maximum length 40.

By specifying query as false, we also specify that no query parameters are allowed or we reject the request. Note that we don't need to specify anything for the payload here, as a payload is never parsed for the GET routes. In fact, even trying to add validation for a HEAD or a GET route will throw an error as a reminder, just as trying to add a validation rule for a parameter that isn't defined in the route path would.

Let's now look at adding validation for POST route. Previously, we applied no validation, which meant that any type of object could be sent as a potential user object. Let's take our userSchema from the previous section, and apply that to the POST route (again, with code removed for brevity):

// Our Schemas
const usernameSchema = Joi.string().min(4).max(40);
const userSchema = Joi.object().keys({
  username: usernameSchema.required(),
  email: Joi.string().email(),
  password: Joi.string().regex(/^[a-zA-Z0-9]{3,30}$/),
  meta: Joi.object()
}).xor('username', 'email');

// Route Configuration
server.route({
  method: 'POST',
  path: '/user',
  config: {
    validate: {
      params: false,
      query: false,
      payload: userSchema
    },
    handler: function (request, reply) {
      // handler logic
    },
    description: 'Create a user'
  }
});

Now with those small additions, we validate all our inputs to the user store in a readable manner. By using joi.object(), we have more options in how we'd like to handle our payload here as well. If we want to accept extra values outside of our defined rules, we can add .unknown() to our userSchema.

Now that we're comfortable validating our route inputs, let's look at how and why we would validate our route responses.

…
server.route(
  method: 'GET',
  path: '/user/{userId}',
  config: {
    validate: {
      headers: true,
      params: {
        userId: Joi.string().min(4).max(40).required()
      },
      query: false
    },
    handler: function (request, reply) {
      // handler logic
    },
    response: {
      schema: Joi.object().keys({
        id: Joi.string().min(4).max(40),
        details123: Joi.object()
      }),
      sample: 100,
      failAction: 'error'
    },
    description: 'Retrieve a user'
    }
  }
);
…