One order-sensitive example is a signed webhook. I would verify the signature against the original request bytes before using the JSON as trusted input. Express’s JSON parser has a verify(req, res, buf) hook for that; re-stringifying req.body can change whitespace and break the signature. Then validate the fields before the route performs any action. Three useful checks are: a valid signature succeeds, one changed byte fails, and malformed JSON reaches the error handler without triggering the action.