With tRPC, is it safe to validate only on the client?
So with REST, we have to validate input on the server since people can bypass client. Is that possible with tRPC? Can I use zod to validate input only on the client side?
11 Replies
Yes it’s possible. Use trpc middleware to protect any routes that require auth
what do you mean
we use privateProcedures for authenticated users yes?
i'm talking about zod validation, can I just use it on the client and not the server?
I thought you were referring to validating the user mb.
Your zod validation will always run for your trpc procedures
So it always runs on the server
if i don't write any validation on the server then how can it run on the server
I want write zod validation only on client side
if you don't validate on the server, anyone can hit your api with malformed requests and break your stuff
why do you not want to validate?
i understand with REST they can do that but is tRPC the same?
Yea of course
Solution
tRPC is also REST
But validating is the default way to work with tRPC
Define Procedures | tRPC
Procedures in tRPC are very flexible primitives to create backend functions; they use a builder pattern which means you can create reusable base procedures for different parts of your backend application.
oh ok i don't really understand how it works under the hood