How do you validate nested request models consistently on both React and ASP.NET Core without trusting the browser?

Validate nested input at the API boundary and enforce invariants again in the domain. Data annotations can cover simple shapes; FluentValidation or custom validators are clearer for conditional and collection rules. Example: RuleFor(x => x.Customer.Email).NotEmpty().EmailAddress(); RuleForEach(x => x.Lines).ChildRules(line => { line.RuleFor(x => x.ProductId).NotEmpty(); line.RuleFor(x => x.Quantity).GreaterThan(0); }); Return RFC 7807 validation details with stable field paths such as lines[2].quantity. Cap collection size and string length before expensive work. Validation does not replace authorization: resolve product and price server-side within the authenticated RestaurantId and OutletId, and never trust nested tenant IDs or totals supplied by the client.

Backbencher Developer · 2026-09-26 · 0 likes