Spring Boot: validation and @Valid?

Question

Accepted Answer

**Bean Validation** — declarative **input data validation** using annotations. Spring Boot integrates Hibernate Validator. **Simple analogy:** Validation is like checking a passport at the border. You show your passport (data), the border guard checks annotations (@NotBlank, @Email) — lets you through or detains you. Without validation, any garbage input reaches your business logic, leading to cryptic database errors, security vulnerabilities, and corrupted data. **Why it matters:** Input validation is the first line of defense against bad data and security attacks (SQL injection, XSS). Declarative annotations (`@NotBlank`, `@Email`) replace dozens of manual `if` checks with readable, self-documenting rules. It also separates validation from business logic — the controller validates the shape, the service processes the data. **Dependency:** ```xml org.springframework.boot spring-boot-starter-validation ``` **DTO with annotations:** ```java public record CreateUserRequest( @NotBlank(message = "Name is required") @Size(min = 2, max = 100, message = "Name must be 2 to 100 characters") String name, @NotBlank @Email(message = "Invalid email") String email, @NotBlank @Size(min = 8, message = "Password must be at least 8 characters") @Pattern(regexp = ".*[A-Z].*", message = "Password must contain an uppercase letter") String password, @Min(value = 18, message = "Minimum age is 18") @Max(value = 120) int age, @Past(message = "Birthday cannot be in the future") LocalDate birthday ) {} ``` **In the controller:** ```java @RestController @RequestMapping("/api/users") public class UserController { @PostMapping public ResponseEntity create(@Valid @RequestBody CreateUserRequest request) { return ResponseEntity.ok(service.create(request)); } } ``` **Custom validation:** ```java @Target({ElementType.FIELD}) @Retention(RetentionPolicy.RUNTIME) @Constraint(validatedBy = PhoneValidator.class) public @interface PhoneNumber { String message() default "Invalid phone number"; Class[] groups() default {}; Class[] payload() default {}; } public class PhoneValidator implements ConstraintValidator { private static final Pattern PHONE_PATTERN = Pattern.compile("^\+?[0-9]{10,15}$"); @Override public void initialize(PhoneNumber annotation) { } @Override public boolean isValid(String value, ConstraintValidatorContext ctx) { return value == null || PHONE_PATTERN.matcher(value).matches(); } } // Usage @PhoneNumber private String phone; ``` **Validation groups** allow you to check different sets of rules in different scenarios: ```java public interface ValidationGroups { interface Create {} interface Update {} } public record UserRequest( @Null(groups = ValidationGroups.Create.class, message = "ID must be null on create") @NotNull(groups = ValidationGroups.Update.class) Long id, @NotBlank String name ) {} // In controller: @PostMapping public ResponseEntity create(@Validated(ValidationGroups.Create.class) @RequestBody UserRequest request) { ... } ``` **Common mistakes:** - **Forgetting `@Valid` on `@RequestBody`** — validation annotations are silently ignored without it. - **Validating at the wrong layer** — validate input in the controller (DTO level), not in the service or entity. - **Relying only on Bean Validation** — complex business rules (e.g., "user must not exceed plan limit") belong in the service layer.

Java: Spring Boot: validation and @Valid?