title: What validation and sanitization do I need on my graphql server?
body: <p>My server is using the following technologies: Node.js, Express, GraphQL, JWT, MongoDB, Mongoose</p>
  <p>Currently, I just have users, with the ability to create, delete, update, and log in to accounts, as well as view all users' usernames, useful for search.</p>
  <p>For authentication, I'm using JWT, Hashed passwords, and using middleware to verify the tokens and provide users' information into graphql context for use by my resolvers.</p>
  <p>I understand that I need security at multiple levels, so I'll outline what I have and maybe you guys can guide me in the direction of what I'm missing.</p>
  <p>Mongoose: Default type validators, required, etc.</p>
  <p>Mongoose-validator: custom validators</p>
  <ul>
  <li>Full Name: Characters, hyphens, spaces, apostrophes only</li>
  <li>Username: alphanumeric, underscore, hyphen and period only, between 4 and 24 chars</li>
  <li>Email: Valid email using mongoose-validator isEmail validator</li>
  <li>Password: 8+ characters, at least one lowercase, uppercase, number</li>
  <li>Birthday: is a date object and is at least 18 years in the past.</li>
  </ul>
  <p>My specific questions are:</p>
  <ul>
  <li>Do I need to use express-sanitizer with this? If so, will it affect special characters in passwords?</li>
  <li>Am I missing any specific type of validation, or is there a checklist for what I should be doing to protect my server?</li>
  </ul>
  <p>Also, any recommendations would be appreciated!</p>