JSON Schema Validation0%
Streaming JSON & NDJSON

JSON Schema Validation

Beginner12 min read•Updated: Jul 11, 2026
Study Materials

JSON Schema Validation in Modern JavaScript

In client-server architectures, relying solely on TypeScript type declarations is insufficient because TypeScript types are completely erased at runtime. When receiving JSON from untrusted external APIs, third-party webhooks, or user forms, runtime JSON Schema Validation (using libraries like Ajv or Zod) guarantees data integrity and security.

1. What is JSON Schema?

JSON Schema is a formal, language-agnostic IETF standard for annotating and validating JSON documents:

JSON
{
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "UserRegistrationPayload",
"type": "object",
"properties": {
"username": { "type": "string", "minLength": 3, "maxLength": 30 },
"email": { "type": "string", "format": "email" },
"age": { "type": "integer", "minimum": 18 },
"roles": {
"type": "array",
"items": { "type": "string", "enum": ["user", "editor", "admin"] }
}
},
"required": ["username", "email"],
"additionalProperties": false
}

2. Validating with Ajv (Another JSON Schema Validator)

Ajv is the industry standard in JavaScript and Node.js for high-speed schema compilation:

JavaScript
import Ajv from 'ajv';
import addFormats from 'ajv-formats';
 
const ajv = new Ajv({ allErrors: true });
addFormats(ajv); // Enable email, uri, date-time formats
 
const userSchema = {
type: 'object',
properties: {
name: { type: 'string', minLength: 2 },
email: { type: 'string', format: 'email' },
role: { type: 'string', enum: ['admin', 'member'] }
},
required: ['name', 'email', 'role'],
additionalProperties: false
};
 
// Compile schema into high-speed validator function
const validateUser = ajv.compile(userSchema);
 
// Validating data
const incomingData = {
name: 'A', // Too short!
email: 'not-an-email', // Invalid format!
role: 'superadmin', // Not in enum!
hackedField: true // Not allowed by additionalProperties: false!
};
 
const isValid = validateUser(incomingData);
 
if (!isValid) {
console.error('Validation Errors:', validateUser.errors);
// Prints detailed structured error list!
} else {
console.log('Payload is safe and valid.');
}

3. Why "additionalProperties": false is Critical for Security

In REST endpoints and webhooks, attackers often submit unexpected payload keys (e.g. isAdmin: true or balance: 999999). This vulnerability is known as Mass Assignment.

Setting "additionalProperties": false ensures that any payload containing undeclared fields is immediately rejected!

Output
Incoming Request ──► Contains { id: 1, role: 'admin' }
│
Schema: additionalProperties: false
│
▼
REJECTED! Unknown property 'role' blocked!

4. JSON Schema vs. TypeScript

DimensionTypeScript InterfaceJSON Schema / Runtime Validator
Execution PhaseCompile time onlyRuntime (evaluates live JSON over network)
Runtime Footprint0 bytes (Erased from JS output)Validates live API responses and webhooks
Constraint DepthTypes only (string, number)Constraints (minLength, regex pattern, minimum)
Interactive Quiz

Practice Quiz

Question 1
Why is TypeScript alone insufficient for validating incoming JSON API responses?
Question 2
What does additionalProperties: false enforce in a JSON Schema?
Question 3
What library is the industry benchmark for high-performance JSON Schema compilation and validation in Node.js and the browser?
Question 4
Which schema constraint ensures a string matches an email format in standard JSON Schema?
Question 5
In an Ajv validation instance, what property contains the list of validation failure descriptions when validate(data) returns false?
Next Lesson

Streaming JSON & NDJSON

Continue learning with hands-on practice, examples, and exercises in the upcoming topic.

Related Lessons

Previous LessonNext Lesson
Circular Reference Handling & Custom SerializationStreaming JSON & NDJSON

Practice Quiz

Test your understanding of this lesson with 5 questions. Each question has one correct answer.

PreviousNext
PrevNext