Validating at the edge
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
reject bad input before it reaches the service.
Planned topics
- Never trust input: clients, scripts, and attackers send anything.
- Validate at the controller boundary, on the request DTO.
- Jakarta Bean Validation: put constraint annotations on fields; add
@Validon the controller parameter. - Frontend checks are for convenience only; the server must check again.
Draft outline details
Demonstration
record CreateProductRequest(@NotBlank String name, @Positive BigDecimal price) {}
@PostMapping
ProductResponse create(@Valid @RequestBody CreateProductRequest req) { ... }Check your understanding
Is frontend validation enough?
Show answer
No; anyone can call the API directly.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.