Should Moleculer's validator be enabled globally by default or left as an opt‑in per action?

Direct Answer

Enable validation globally by default (validator: true at the broker level) and define JSON schemas on every action. Treat per-action validation: false as a documented exception for measured performance-critical paths only. This prevents silent data corruption, ensures consistent behavior across environments, and avoids policy drift as new actions are added.

Risks of Keeping Validator Disabled Globally

• Silent payload acceptance: Missing required fields, wrong types, oversized strings, and malformed objects reach handlers without ValidationError (HTTP 400). Errors surface later as runtime exceptions, database constraint violations, or corrupted downstream state.
• Environment divergence: Local development with validator: false passes invalid requests that would fail in production if validation is enabled there — or vice versa — creating "works on my machine" failures.
• No startup signal: Moleculer emits no warning when validator: false is set. The only observable difference is the absence of ValidationError responses, which often goes unnoticed until logs show anomalous behavior.
• Internal call bypass: Service-to-service calls (via broker.call()) skip API-gateway validation entirely. Disabling service-level validation leaves internal traffic completely unchecked.
• Security exposure: Unvalidated input enables injection-style attacks (NoSQL/SQL via malformed objects, prototype pollution via unexpected keys, DoS via oversized payloads).

Enforcing a Uniform Policy Without Breaking Existing Services

1. Enable globally in a branch: Set validator: true in the broker config (this is the default in Moleculer 0.14+).
2. Run the test suite: Actions without params schemas will now throw ValidationError for any parameter mismatch. Failures identify exactly which actions need schemas.
3. Add schemas incrementally: For each failing action, define a strict params schema (JSON Schema draft-07 via AJV). Use type: "object", additionalProperties: false to reject unknown fields.
4. Documented exceptions only: If an action genuinely cannot have a schema (e.g., generic proxy, dynamic payload), add validation: false on that action with a code comment linking to a performance benchmark or architectural decision record.
5. Lock it in CI: Add an ESLint rule or custom script that flags actions missing params when global validator: true is set. Example pattern:

   // .eslintrc.js rule concept
   "moleculer/require-action-schema": ["error", { "globalValidator": true }]

6. Configure AJV once: Use validatorOptions at broker level for strict mode, coercion settings, or custom keywords — avoid duplicating per action.

   // moleculer.config.js
   module.exports = {
     validator: true,
     validatorOptions: {
       strict: true,
       coerceTypes: false,
       allErrors: true
     }
   };

Why Global Default True Is Safer Than Per-Action Opt-In

Version-Specific Notes

• Moleculer 0.14+: validator: true is the default. validatorOptions supports AJV 8 strict mode.
• Pre-0.13: Looser coercion defaults; upgrading may surface new validation failures even with unchanged schemas. Test after upgrade.
• Custom middleware: If you mutate ctx.params before validation runs, place validation early in the middleware chain or use validatorOptions.customKeywords to avoid false negatives.

Verification Steps

1. Start broker with validator: true and no action schemas — call any action with invalid params; expect ValidationError.
2. Set validator: false globally, call an action with invalid params — observe no ValidationError, handler receives raw payload.
3. Add validation: true to a single action while global validator: false — only that action validates.
4. Check broker startup logs for "Validator initialized" confirming AJV instance creation.

One Diagnostic Detail Needed

What Moleculer version is currently deployed in production? (Pre-0.13 vs 0.14+ changes the default coercion behavior and affects how many existing actions will fail when validation is enabled globally.)