Request Validation

Why Validate?

Malicious/invalid input:
- SQL injection: "'; DROP TABLE users;--"
- XSS: "<script>alert('hack')</script>"
- Oversized data: 1GB payload
- Wrong types: string where int expected
- Missing required fields

Validation Layers

Client Input
    |
    v
[Client-side validation] → Quick feedback
    |
    v
[API Gateway validation] → Rate limits, content type
    |
    v
[Controller validation] → Format, required fields
    |
    v
[Service validation] → Business rules
    |
    v
[Database constraints] → Data integrity

Validation in Spring Boot

public class CreateProductRequest {
    @NotBlank(message = "Name is required")
    @Size(min = 2, max = 100)
    private String name;

    @NotNull(message = "Price is required")
    @Positive(message = "Price must be positive")
    private BigDecimal price;

    @Email(message = "Invalid email format")
    private String sellerEmail;

    @Pattern(regexp = "^[A-Z]{2}-[0-9]{8}$")
    private String productCode;
}

Validation Error Response

{
  "error": "VALIDATION_ERROR",
  "message": "Request validation failed",
  "details": [
    { "field": "name", "message": "Name is required" },
    { "field": "price", "message": "Price must be positive" }
  ]
}

Validation Layers

1. Client-side: Immediate feedback
2. API Gateway: Basic validation
3. Service: Business rules
4. Database: Constraints

Types

• Type checking
• Format validation (email, phone)
• Range checking
• Length limits
• Business rules

Best Practices

• Validate on server (never trust client)
• Return specific error messages
• Use whitelist approach
• Log validation failures

Key Points

• Understanding Request Validation is essential for production systems
• Always consider scalability and maintainability
• Test thoroughly before deploying to production
• Monitor performance and set up alerting

Common Patterns

1. Validation: Always validate input at the boundary
2. Error Handling: Use structured error responses
3. Logging: Log key events for debugging
4. Testing: Unit, integration, and load tests
5. Documentation: Keep docs updated with code changes