How to handle Resource validation in REST webservices?

Question

I\'m building a REST webservice in Java using Spring, Jersey and Hibernate (JPA).

Now I\'m trying to add support for validation in my resources. JSR-303 (Bean valida

Answer 1

Oval is the best package to evaluate an object. It is very useful to generate a unit test assertion and automated test.

Answer 2

The solution ended up to be subclassing Jackson's JacksonJaxbJsonProvider which implements a JAX-RS MessageBodyReader and MessageBodyWriter. I was inspired by the amazing dropwizard's approach. In this provider we need to somehow Inject a Validator instance (I used Spring for Injection and Hibernate Validator for JSR-303 implementation). If you use Hibernate ORM don't forget to disable entity validation, otherwise you will be validating the same entity twice. It may be what is desired, though.

Then, in this subclassed MessageBodyReader, I validate the object and throw a custom InvalidEntityException with the errors from the validator. I also created a JAX-RS ExceptionMapper<InvalidEntityException> that maps every InvalidEntityException into a proper HTTP response. In my case I returned a Bad Request and a JSON object containing the errors description.

Notice that this MessageBodyReader checks for @Valid and @Validated annotations. This means that it correctly supports groups. This is important because we probably don’t want to do the same kind of validation across our entire application. An example is when we want to do a partial update (PUT). Or, for example, an id property must be null in a POST request but non-null everywhere else.

Data Integrity Validations aren't completely dealt with yet. But I'm planning to catch database exceptions and converting them to my own domain exceptions (say a DataIntegrityException) as it seems more efficient and loosely coupled to me.

---

UPDATE:

Since JAX-RS 2, the recommended way to do this is to use its Bean Validation support. Check here: https://jersey.java.net/documentation/latest/bean-validation.html

Answer 3

You can now use Jersey 2.0 for validation of resource arguments via JSR-303/JSR-349.

https://jersey.java.net/documentation/latest/bean-validation.html#d0e9301

Answer 4

You can make use of jersey filters, where you can make some validations on your request data.

Well, the category with id 123 might not exist. If we try to insert this into the database, obviously we get a foreign key related exception.

For such cases, one can rely on the validations on data access level. But if you want to respond to your client synchronously, it is usually better to have this business logic exposed by some service API. i.e. You may have an API like isValidCategory(int id), which can be queried at a higher level than DAO so that you don't really have to wait till the data access layer encounters an error/exception. Obviously, this can still mean a database lookup (depends on your system), but optimizing that to improve your response time using Caching or some other mechanism is an entirely different problem altogether.

Talking about bean validators, you can take a look at Hibernate Validator which is a JSR 303 implementation.