Each Next.js project have the possibility of using a serverless api using route handlers and usually in like the "api" folder. But for me I don't want that malicious users could send requests to the serverless API, because it can leads to problems.

Let's take an example:

To create and add a new user to the database, I have a post request to the route '/api/user' ; Here is the code:

export async function POST(request) {
  const { email, password } = await request.json()

  try {
    const createdUser = await Users.create(password ? { email, password } : { email })
    return NextResponse.json({ user: createdUser }, { status: 201 })
  } catch (err) {
    // contrainte d'unicité: email déjà utilisé!
    if (err.code === 11000) {
      return NextResponse.json({
        message: "Cet email est déjà utilisé par un autre utilisateur!"
      }, { status: 422 })
    }
    console.log(err)
  }
}

The problem here is that I validate the email and password beforehand and so a user may create a new user specifying any "email" he wants even if it isn't an email, I don't know much about security but even I, can see that it can be really bad if there's a possibility to inject code through this flaw.

So for me I can envisage only two solutions.

1. restrain users to send requests to the serverless API, maybe by assuring only the machine that host the project can send requests. (I don't know if it possible but why not if we can blacklist only one IP to have the authorization to send serverless API calls.)

2. instead of validate data beforehand, prefer to do it server-side, when the request is sent. In this case for example, It would mean to verify the email and password just before the try and catch. (that sounds like the right approach for me if I had to give my opinion)

I want a reply based on which solution is the most efficient and secure, what's the best approach to adopt right here, considering that the 1st solution might be just impossible to do.