How to Validate Requests Using Serverless Framework

Serverless Framework is a tool that allows you to create and deploy serverless applications using various cloud providers, such as AWS, Azure, Google Cloud, and more. Serverless Framework simplifies the development and management of your serverless functions, events, resources, and configuration.

One of the features that Serverless Framework provides is the ability to validate requests using API Gateway. You can use request validation to check the validity of the request body, parameters, and headers before invoking your lambda function. This can help you prevent invalid or malicious requests from reaching your function and improve the security and performance of your application.

In this blog post, we will show you how to validate requests using Serverless Framework with AWS as the cloud provider. We will also explain some of the benefits and limitations of request validation, and provide some tips and best practices.

What is Request Validation?

Request validation is a feature that allows you to specify a JSON schema for your request body, parameters, and headers. API Gateway will use this schema to validate the incoming requests and reject them if they don’t match the schema. You can also specify whether the validation is required or optional for each part of the request.

Request validation can help you achieve several benefits, such as:

Security: You can prevent invalid or malicious requests from reaching your function and potentially causing errors or vulnerabilities.
Performance: You can reduce the amount of processing and memory required by your function by filtering out unwanted requests.
Consistency: You can ensure that your function receives consistent and well-formed requests that match your expectations and specifications.

How to Validate Requests Using Serverless Framework?

To validate requests using Serverless Framework, you need to have the following:

An AWS account with the required permissions to create and manage API Gateway and Lambda resources.
A Serverless Framework project with a serverless.yml file that defines your functions, events, resources, and configuration.
A JSON schema file that defines the structure and constraints of your request body, parameters, or headers. You can use tools like JSON Schema Generator or JSON Schema Validator to create and test your schema.

The steps to validate requests using Serverless Framework are as follows:

Open your serverless.yml file and add a request section under the http event of your function. For example:

functions:
  hello:
    handler: handler.hello
    events:
      - http:
          path: hello
          method: post
          request:
            # add request validation here

functions:

hello:

handler: handler.hello

events:

- http:

path: hello

method: post

request:

# add request validation here

Under the request section, add a schemas section that specifies the content type and the schema file for your request body. For example:

functions:
  hello:
    handler: handler.hello
    events:
      - http:
          path: hello
          method: post
          request:
            schemas:
              application/json: ${file(models/hello.json)} # reference to your schema file

functions:

hello:

handler: handler.hello

events:

- http:

path: hello

method: post

request:

schemas:

application/json: ${file(models/hello.json)} # reference to your schema file

Optionally, under the request section, add a parameters section that specifies the query string parameters or path parameters for your request. For each parameter, you can specify whether it is required or optional, and provide a schema file for validation. For example:

functions:
  hello:
    handler: handler.hello
    events:
      - http:
          path: hello/{name}
          method: get
          request:
            parameters:
              paths:
                name: true # required parameter
              querystrings:
                age: false # optional parameter
                ${file(models/age.json)} # reference to schema file

functions:

hello:

handler: handler.hello

events:

- http:

path: hello/{name}

method: get

request:

parameters:

paths:

name: true # required parameter

querystrings:

age: false # optional parameter

${file(models/age.json)} # reference to schema file

Optionally, under the request section, add a headers section that specifies the headers for your request. For each header, you can specify whether it is required or optional, and provide a schema file for validation. For example:

functions:
  hello:
    handler: handler.hello
    events:
      - http:
          path: hello
          method: post
          request:
            headers:
              Authorization: true # required header
              ${file(models/auth.json)} # reference to schema file
              Content-Type: false # optional header

functions:

hello:

handler: handler.hello

events:

- http:

path: hello

method: post

request:

headers:

Authorization: true # required header

${file(models/auth.json)} # reference to schema file

Content-Type: false # optional header

Deploy your serverless project using the command serverless deploy.

After deploying your project, API Gateway will use the specified schemas to validate the incoming requests and reject them if they don’t match the schemas. You can test your API using tools like Postman or curl and see how API Gateway responds to valid or invalid requests.

Tips and Best Practices for Request Validation

Here are some tips and best practices to help you use request validation effectively:

Before creating your schema files, make sure that you understand the JSON schema specification and syntax. You can use tools like JSON Schema Generator or JSON Schema Validator to create and test your schemas.
Before deploying your project, make sure that you test your schemas locally using tools like ajv-cli or jsonschema-cli. You can also use the serverless-offline plugin to emulate API Gateway and Lambda locally and test your request validation.
After deploying your project, make sure that you monitor and debug your API using tools like AWS CloudWatch or AWS X-Ray. You can also use the serverless-plugin-aws-alerts plugin to create alerts and notifications for your API errors and metrics.

Conclusion

In this blog post, we have shown you how to validate requests using Serverless Framework with AWS as the cloud provider. We have also explained some of the benefits and limitations of request validation, and provided some tips and best practices.

We hope this post has helped you understand how to use Serverless Framework to improve the security and performance of your serverless applications. If you have any questions or feedback, please leave a comment below.