Configuration often feels trustworthy because it arrives through a deployment setting rather than a request body. But the application still has to interpret it. A variable can be missing, blank, misspelled, or valid text with the wrong meaning.
Node.js documents that values loaded from .env files are strings. A value written as false is therefore text, not a Boolean. Passing it through Boolean(value) would enable the option because a nonempty string is truthy.
The useful boundary is startup: convert raw settings into a validated configuration object before accepting work.
Suppose a worker has a concurrency setting. For this example, the application permits decimal integers from 1 to 64. Its parser can make that policy explicit:
function readConcurrency(raw) {
if (raw === undefined) return 4
const value = raw.trim()
if (!/^[0-9]+$/.test(value)) {
throw new Error("WORKER_CONCURRENCY must contain decimal digits")
}
const concurrency = Number(value)
if (!Number.isInteger(concurrency) || concurrency < 1 || concurrency > 64) {
throw new Error("WORKER_CONCURRENCY must be an integer from 1 to 64")
}
return concurrency
}The default applies only when the variable is absent. An empty string, 8jobs, and zero fail visibly instead of quietly becoming a different operating policy. Number.isInteger checks the converted value; the range check expresses the application’s limit.
The same approach works for other settings: accept only documented Boolean spellings, parse URLs with an allowed protocol, and check that a timeout’s unit is unambiguous. After validation, pass the resulting object to the code that needs it. That keeps conversion rules in one place.
Error messages should name the setting and the expected shape. Avoid printing the entire environment or secret values just to explain a failed check.
Startup validation cannot prove that a database is reachable or a credential is authorized. It can establish that the application understands the configuration it received.
A small review question makes this practical: What happens if this setting is present but wrong? If the answer depends on accidental coercion, the parsing boundary needs attention.