API Design · Junior · Question 36 of 75

Why should an API validate all input even if the official client already does?

1Validation makes responses cacheable
2Clients can't validate data
✓Correct answer: Anyone can call the API directly with any data; the server is the only trusted boundary

Explanation

Validate types, ranges, formats and sizes, and reject unknown fields to avoid mass assignment.

Further reading

Test yourself

Take the API Design · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.