title: Where to validate in Express.js project – Validation at the database layer (re. Mongoose)?
body: <p>I am writing an application with a form in Express.js, and to begin with, I was doing all of my validation in the route (or controller, if you like):</p>
  
  <pre><code>app.post('/register', function (req, res, next) {
    // Generic validation
    req.assert('name', 'Name is empty').notEmpty();
    req.assert('username', 'Username is empty').notEmpty();
    var errors = req.validationErrors(true);
    if (errors) {
      // If there are errors, show them
    } else {
      // If there are no errors, use the model to save to the database
    }
  });
  </code></pre>
  
  <p>However, I quickly learnt that my validation should be happening in the model, keeping inline with the "thin controller, fat model" principle.</p>
  
  <p>Model:</p>
  
  <pre><code>var userSchema = new Schema({
      name: {
        type: String
      , required: true
      , validate: [validators.notEmpty, 'Name is empty']
      }
    , username: {
        type: String
      , required: true
      , validate: [validators.notEmpty, 'Username is empty']
      }
   , salt: String
   , hash: String
  });
  </code></pre>
  
  <p>Route/controller:</p>
  
  <pre><code>app.post('/register', function (req, res, next) {
    var newUser = new User(req.body);
    // Tell the model to try to save the data to the database
    newUser.save(function (err) {
      if (err) {
        // There were validation errors
      } else {
        // No errors
      }
    });
  });
  </code></pre>
  
  <p>This works well. However, I need to do validation prior to the database layer. For instance, I need to <a href="https://stackoverflow.com/questions/13982159/validating-password-confirm-password-with-mongoose-schema/13992653#13992653">check if two passwords are the same</a> (<code>password</code> and <code>confirmPassword</code>). This cannot be defined in the schema, as I am only saving <code>salt</code> and <code>hash</code> in the model. Therefore, I need to do this validation before the database layer, in the route/controller. Because of this, I will not be able to display validation messages together.</p>
  
  <p>Is this the best way thing to do things – validating in the model at the database layer, as well as in the controller? Is it better to have all of my validation in the controller like before? But then I will be repeating code where I save to the model again. Or should I use another pattern, and if so, what?</p>