Express-Validator fail on unknown key - node.js

Question

I am working with nodejs, express, and express-validator to create a type safe rest api.
What I want is that when the user passes in a request that contains one or many extra keys that the validation fails.
These are my validator rules:
const prepaidValidationRules = () => {
return [
body('accountHolder').exists().isString(),
body('amount').exists().isFloat()
]
}
Now when some sends the following request body:
{
"amount": 20.0,
"accountHolder": "Claude"
}
Then the validation succeedes as expected, but when I send the following request body:
{
"amount": 20.0,
"accountHolder": "Claude",
"extrakey": "someValue"
}
Then I want the validation to fail.
Is there anyway to do this using express-validaiton.
Thank you very much for any help :)

Answer 1

You can disallow unknow fields with express-validator, but you need to do an extra function.
The middleware function:*
import { validationResult } from 'express-validator'
export function validate (validators, allowExtraFields = false) {
return async (req, res, next) => {
// You can meka the validation optional
if (!allowExtraFields) {
// Fields validation
const extraFields = checkIfExtraFields(validators, req)
if (extraFields) { res.status(400).json({ error: true, message: 'Bad request' }) }
}
// Type validation
await Promise.all(validators.map((validator) => validator.run(req)))
const errors = validationResult(req)
if (errors.isEmpty()) {
return next()
}
logger.error(`${req.ip} try to make a invalid request`)
return res.status(400).json({ error: true, errors: errors.array() })
}
}
function checkIfExtraFields (validators, req) {
const allowedFields = validators.reduce((fields, rule) => {
return [...fields, ...rule.builder.fields]
}, []).sort()
// Check for all common request inputs
const requestInput = { ...req.query, ...req.params, ...req.body }
const requestFields = Object.keys(requestInput).sort()
if (JSON.stringify(allowedFields) === JSON.stringify(requestFields)) {
return false
}
logger.error(`${req.ip} try to make a invalid request`)
return true
}
Usage
import { body, query } from 'express-validator'
const validator = [
body('email').isEmail().exist(),
query('new').isString(),
]
router.post(
'/user',
validate(validator ), // By default all extrange fields are rejected
handler.post
)

Answer 2

This one works to me
const { body } = require("express-validator");
...
...
body().custom((body) => {
const allowedKeys = [
"name",
"age",
"bio",
];
for (const key of Object.keys(body)) {
if (!allowedKeys.includes(key)) {
throw new Error(`Unknown property: ${key}`);
}
}
return true;
}),

Answer 3

I will leave this here if someone wants to achieve the same.
I simply used currying to achieve what I wanted:
app.post("/someRoute", validationRule(), validate(2), doSomething());
validate function
function validate(nmbOfExpectedKeys) {
return (req, res, next) => {
if (Object.keys(req.requestBody) > nmbOfExpectedKeys)
return res.status(422);
}
}