tRPC Middleware Ordering: Validation Before or After?

Answers to Your Questions

1. Future config flag: As of the current knowledge cutoff, no public RFC, roadmap item, or maintainer statement confirms a configuration flag to run validation before middleware in a future major release. The execution sequence is hard-coded in tRPC v10+.
2. v9 to v10 upgrade impact: This is a breaking change. In v9, middleware ran after validation and received already-validated input. In v10+, middleware runs before the built-in .input() validation and receives raw, unvalidated data. Middleware that accesses nested properties, trusts string formats, or makes authorization decisions on parsed fields may misbehave or expose security gaps. No automated migration tool exists for this behavioral change; a manual audit of every .use() middleware is required.
3. Security mitigations: Treat middleware input as untrusted. Use defensive existence checks and type guards, prefer zod.safeParse() over parse() inside middleware, or move validation-dependent logic (authentication, rate-limiting on parsed fields) into the procedure resolver where validation has already passed.

Confirmed Behavior (tRPC v10+)

• Middleware chain executes before the built-in .input() validation step.
• Ordering among multiple middlewares follows the array order passed to .use().
• Validation still runs before the resolver; only the middleware position changed.
• No configuration option exists in v10+ to swap the sequence.

Uncertain or For Review

Whether a future major release will add a flag to reverse the order is unknown. No public RFC or roadmap item confirms this. Treat the current hard-coded sequence as the stable contract and plan middleware accordingly.

Practical Verification Steps

1. Create a minimal tRPC v10+ project.
2. Add a middleware that logs opts.rawInput (or the equivalent raw input reference in your adapter).
3. Define a procedure with a strict Zod schema, e.g. z.object({ id: z.number() }).
4. Send a request with invalid data, e.g. { id: "not-a-number" }.
5. Observe that the middleware receives the raw invalid value; the validation error surfaces afterward.

Recommended Migration Checklist

• Inventory all .use() middlewares.
• For each, identify any property access, type assumptions, or authorization logic that depends on validated shape.
• Refactor: either add defensive guards inside the middleware or move that logic into the resolver.
• Test with malformed payloads to confirm middleware no longer throws on invalid input.

One Diagnostic Detail

If any middleware currently reads input.userId, input.token, or similar fields to make authorization decisions, that logic is the highest-risk migration target and should move to the resolver. Confirm whether your middleware performs authorization based on parsed input fields, because this changes the recommended refactor.