Validating Input: Where and Why?

When building robust applications, especially backend systems, a key concern is data validation. The IT-Academy-BCN/ita-challenges-backend project recently addressed this question: where should input validation occur, and what are the trade-offs?

The Dilemma

The core debate centered around validating UUIDs in the context of user submissions. Should the validation happen in the controller, the service layer, or even the DTO? Different developers had different perspectives.

The initial approach involved validating UUIDs in the controller. However, concerns arose about the reusability of the service layer. What if the service needed to handle events originating from a different source, bypassing the controller's request object?

The Resolution

The team converged on a solution that prioritizes validation in the service layer. Here's why:

• Reusability: Services should be independent of specific request objects. Validating within the service ensures that any entry point, whether a controller or a domain event handler, receives validated data.
• Consistency: By centralizing validation logic, you avoid duplication and ensure consistent rules across the application.
• DTO Validation: The team also recognized the importance of validating the Data Transfer Object (DTO) itself, ensuring that the data structure conforms to expectations early in the process.

For example, consider this generic scenario. A DTO represents user input:

public class UserInput {
    private String userId;
    private String data;

    public UserInput(String userId, String data) {
        this.userId = userId;
        this.data = data;
    }

    public String getUserId() {
        return userId;
    }

    public String getData() {
        return data;
    }
}

Instead of validating userId only in the controller, a validation annotation within the DTO can enforce rules:

public class UserInput {
    @genericUUIDValid
    private String userId;
    private String data;

    public UserInput(String userId, String data) {
        this.userId = userId;
        this.data = data;
    }

    public String getData() {
        return data;
    }

    public String getUserId() {
        return userId;
    }
}

And then, within the service layer:

public class UserService {
    public void processInput(UserInput input) {
        // Validation is guaranteed by the DTO and/or service-level checks
        String userId = input.getUserId();
        // ... further processing
    }
}

The Takeaway

Input validation isn't just about preventing errors; it's about architectural integrity. By validating in the service layer and DTOs, you create a more robust, reusable, and maintainable application. Don't confine validation to the entry points; distribute it strategically for maximum impact.

Generated with Gitvlg.com