Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Before an API uses JSON, check it in stages: enforce request limits and the expected media type, parse it with a JSON parser, validate its structure and business rules, then use the validated representation. Formatting is a separate concern: pretty-printed and compact JSON can both be valid, but neither proves that the data meets an endpoint’s contract.
What validation checks—and what it does not
JSON syntax determines whether text can be parsed as a JSON value. RFC 8259 defines JSON values as objects, arrays, strings, numbers, booleans, or null, and permits whitespace around structural characters. A successful parse does not establish that the value has the fields, types, or meaning your endpoint requires. RFC 8259
As an Amazon Associate I earn from qualifying purchases.
Keep three checks distinct:
- Parsing: Is the request body valid JSON text?
- Schema or structural validation: Does the parsed value have the permitted shape and types?
- Business validation: Does the data make sense for this operation, including rules that depend on the relationship between fields or the application’s current state?
For example, a parser can accept an object containing a numeric quantity, but only the endpoint’s contract and business rules can determine whether that quantity is required, within an allowed range, or appropriate for the requested operation.
Validate a JSON request in a safe order
- Check the HTTP request envelope. Confirm that the endpoint accepts a body and that the request uses an allowed media type. For JSON, that is typically
application/json; follow the API contract and reject unsupported content types. OWASP’s REST guidance covers request content types and handling unsupported media types. OWASP REST Security Cheat Sheet - Limit resource use before parsing. Apply a request-body size limit before buffering or parsing. Configure parser limits appropriate to the service, including nesting depth and any relevant string or number constraints. Schema validation happens after parsing, so it cannot protect a parser that has already been strained by an oversized or deeply nested body. OWASP JSON Validation Cheat Sheet and RFC 8259, section 9
- Parse with a maintained JSON parser. Treat malformed JSON as an input error and stop processing it. Do not parse JSON with JavaScript
evalor another eval-like mechanism: input must be treated as data, not executable code. RFC 8259 section 9 describes the parser’s role as transforming JSON text into another representation. RFC 8259, section 9 - Validate the parsed structure. Check the top-level type, property types, required fields, nested objects, and array items and lengths where relevant. Explicitly decide whether unrecognized properties are allowed. A property appearing in a schema does not, by itself, necessarily make it required or cause extra properties to be rejected. OWASP JSON Schema Validation Cheat Sheet
- Apply the endpoint’s business rules. Check conditions that describe acceptable meaning or state, not just shape—for example, whether two fields are consistent or a quantity is acceptable for the requested operation.
- Use the same validated representation downstream. Avoid decoding or interpreting the original input again later under different rules. Repeated or inconsistent decoding can undermine checks already performed. OWASP JSON Validation Cheat Sheet
Make the schema policy explicit
A useful schema states what the endpoint accepts, rather than merely listing familiar field names. Define required properties separately from optional ones; specify types and constraints for nested objects and array items; and choose whether extra properties should be rejected, ignored, or accepted. Apply the policy consistently across endpoints and document it as part of the API contract.
#1 Best Overall
Schema checks do not replace domain logic. A format assertion, such as one for an email address or URL, generally checks syntax; it does not prove that an address exists, that a URL is reachable, or that the referenced resource is authorized for the caller. The JSON Schema validation specification describes format validation as generally syntactic and calls for implementations to document limitations. JSON Schema Validation, Draft 2020-12
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Format JSON without confusing readability with validity
Formatting changes the textual presentation of structured data. Pretty output inserts indentation and line breaks to help people inspect a body; compact output removes unnecessary whitespace and is often convenient for transport. RFC 8259 permits insignificant whitespace around JSON structural characters, so either style can be valid when generated according to JSON grammar. Neither style validates the data against the API contract. RFC 8259, section 2
Use a JSON serializer or generator to produce output instead of assembling JSON through string concatenation. Select pretty output for logs, examples, or manual review when useful; use compact output when smaller, less cluttered request text is preferable. Do not assume a parse-and-serialize cycle preserves the original bytes: generators may normalize number or string representations, and implementations may not preserve object member order. Application behavior should not depend on object property order.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Rank #3
Interoperability and security checks that are easy to miss
- Duplicate member names: JSON objects with repeated names can be handled differently by parsers: one may retain the last value, another may reject the object, and another may expose duplicate pairs. Reject duplicates if the parser supports that policy, or define and test a consistent policy across systems. RFC 8259, section 4
- Limits on depth and values: RFC 8259 permits parsers to set implementation limits. Consider nesting depth, number range or precision, and string length as well as total request size. RFC 8259, section 9
- Character encoding: JSON exchanged between systems outside a closed ecosystem must use UTF-8. A generator must not add a byte-order mark to network-transmitted JSON. RFC 8259, section 8.1
- Error responses: Tell callers which input check failed in a way they can act on, but do not expose stack traces or unnecessary implementation details. OWASP REST Security Cheat Sheet
A practical pre-use checklist
- The endpoint accepts a request body and the request Content-Type is supported.
- Body-size and parser resource limits are enforced before parsing.
- A JSON parser—not an eval-like function—rejects malformed input.
- The schema specifies required fields, types, nested constraints, and a deliberate policy for extra properties.
- Business rules check the data’s meaning for the operation.
- Downstream code uses the validated parsed representation without reinterpreting the raw body.
- Serialization uses a JSON generator; output formatting is chosen for its audience, not treated as a validation step.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
