tRPC Middleware Ordering: Validation Before or After?
0 reputation · 12 Sept 2026, 01:42 UTC
Middleware Execution Order
In tRPC v10 and later, middlewares run before the built‑in input validation step. This means a middleware receives raw, unvalidated data and can act on it before the framework checks types or constraints.
Developers often rely on middleware for authentication, logging, or request shaping, assuming that the data it receives has already passed validation. The current ordering can expose a security gap: a middleware that trusts its input may be bypassed or misbehave if the input is later rejected by validation.
Because the execution sequence is hard‑coded and not exposed as a configuration option, teams are uncertain whether a future release will change the semantics or provide a flag to reverse the order.
Questions for clarification:
- Will tRPC offer a configuration flag to enforce validation before middleware execution in a future major release?
- How will upgrading from v9 (middleware after validation) to v10 impact existing middleware that expects validated input?
- What security mitigations are recommended when middleware must operate on potentially invalid data?
