Input valuation on server?

[davesteinberg]

I've just been watching and reading some of your introductory material, haven't actually started trying anything out, but I'm super impressed by everything I've seen so far.

All of the server$/createServerData$/createServerAction$ magic immediately raised a question for me, and I haven't found an answer yet.

It's all very cool. I really like the simplicity of the approach and the ability to mix server code and client code that uses it together in the same module.

Coming from tRPC, one thing jumps out as missing: input valuation. Type safety is very nice to have, but it's not enough on the server, is it? Once my function gets exposed as a handler for HTTP requests, anyone can send anything they want to it. If that function makes assumptions about the types of inputs, that seems extremely dangerous.

Is this risk mitigated somehow?

[ryansolid]

You can run whatever you want inside a server function. So I imagine you could use something like zod.

[davesteinberg]

Hi Ryan,

Thanks for the reply, and for all the awesomeness in Solid and SolidStart.

I'm curious if you gave any thought to taking inspiration from the way tRPC separates input validation from the actual implementation of a query or mutation? And if so, why you decided against?

I can see three main benefits to having an explicit input validator alongside each server function:

1. It would allow you to run it only when needed: when handling an HTTP request, but not when called directly during SSR.

2. It would directly encourage developers to secure their servers by doing input validation, rather than leaving it to them to do if they think of it.

3. It would lead to nicer TypeScript. It feels a bit off to pass already-typed inputs to a Zod schema. Whereas, in tRPC, inferring input types on the implementation from the schema feels magical and amazing. I think this actually relates to point 2, as well: developers are more likely to do what feels good, so we should make good practices feel good to encourage them.

I'm really interested to hear your thoughts on this if you feel like sharing them.