How do I validate incoming JSON data inside a REST service?

Question

A rest service needs to validate all incoming json data against a json schema. The json schemas are public accessible and can be retrieved via http requests.

I\'m us

Answer 1

It looks like you're not tied to JSONSchema, though it seems to be your default choice. Tastes differ, but oftentimes it looks more complicated then it could. Besides, personally, I'd love to have both data and validation rules in the same place. And custom validators arguably seem to fit more naturally when used within java code instead of any sort of configuration files.

Here is how this approach looks like. Say, you have the following json object representing some payment (be it a request or response), but consisting only of discount block for brevity:

{
    "discount":{
        "valid_until":"2032-05-04 00:00:00+07",
        "promo_code":"VASYA1988"
    }
}

Here is what a validation code looks like:

/*1 */    public class ValidatedJsonObjectRepresentingRequestOrResponse implements Validatable
          {
              private String jsonString;
              private Connection dbConnection;

/*6 */        public ValidatedJsonObjectRepresentingRequestOrResponse(String jsonString, Connection dbConnection)
              {
                  this.jsonString = jsonString;
                  this.dbConnection = dbConnection;
              }

              @Override
/*13*/        public Result result() throws Exception
              {
                  return
/*16*/                new FastFail<>(
/*17*/                    new WellFormedJson(
/*18*/                        new Unnamed<>(Either.right(new Present<>(this.jsonRequestString)))
/*19*/                    ),
/*20*/                    requestJsonObject ->
/*21*/                        new UnnamedBlocOfNameds<>(
                                  List.of(
/*23*/                                new FastFail<>(
/*24*/                                    new IsJsonObject(
/*25*/                                        new Required(
/*26*/                                            new IndexedValue("discount", requestJsonObject)
                                              )
                                          ),
/*29*/                                    discountObject ->
/*30*/                                        new NamedBlocOfNameds<>(
/*31*/                                            "discount",
/*32*/                                            List.of(
/*33*/                                                new PromoCodeIsNotExpired(
/*34*/                                                    new AsString(
/*35*/                                                        new Required(
/*36*/                                                            new IndexedValue("valid_until", discountObject)
                                                              )
                                                          )
                                                      ),
/*40*/                                                new PromoCodeIsNotAlreadyRedeemed(
/*41*/                                                    new PromoCodeContainsBothLettersAndDigits(
/*42*/                                                        new Required(
/*43*/                                                            new IndexedValue("promo_code", discountObject)
                                                              )
                                                          ),
/*46*/                                                    this.dbConnection
                                                      )
                                                  ),
/*49*/                                            Discount.class
                                              )
                                      )
                                  ),
/*53*/                            JsonObjectRepresentingRequestOrResponse.class
                              )
                      )
                          .result();
              }
          }

Let’s see what’s going on here, line by line:

Line 1 Declaration of ValidatedJsonObjectRepresentingRequestOrResponse.
Line 6 Its constructor accepts raw json string. It might be either an incoming request or received response, or pretty much anything else.
Line 13: Validation starts when this method is invoked.
Lines 16: The higher-level validation object is FastFail block. If the first argument is invalid, an error is returned right away.
Lines 17-19: json is checked whether it’s well-formed or not. If the latter, validation fails fast and returns a corresponding error.
Line 20: if json is well-formed, a closure is invoked, and json data is passed as its single argument.
Line 21: json data is validated. Its structure is an unnamed block of named blocks. It corresponds to a JSON Object.
Line 26: The first (and the only) block is called discount.
Line 25: It’s required.
Line 24: It must be a json object.
Line 23: If not, an error will be returned right away because it’s a FailFast object.
Line 29: Otherwise, a closure is invoked.
Line 30: Discount block is a named block consisting of other named entries – objects or scalars.
Line 36: The first one is called valid_until
Line 35: It’s required.
Line 34: And represented as a string, if it's really a string. If not, an error will be returned.
Line 33: Finally, check that it’s not expired.
Line 43: Second parameter is called promo_code.
Line 42: It’s required as well.
Line 41: It must contain both letters and digits.
Line 40: And it should not be already redeemed. This fact is certainly persisted in our database, hence …
Line 46: … this.dbConnection parameter.
Line 49: If all previous validation checks are successful, an object of class Discount is created.
Line 53: Finally, JsonObjectRepresentingRequestOrResponse is created and returned.

Here is how a calling code looks when validation is successful:

Result result = new ValidatedJsonObjectRepresentingRequestOrResponse(jsonRequestString).result();
result.isSuccessful();
result.value().raw().discount().promoCode(); // VASYA1988

This example is taken from here. Here you can find a full-fledged json request validation example.