1

I am looking for best practices regarding server-side validation and handling of validation errors on the server side.

My business logic is about updating a Curriculum entity. The browser consumes a Spring MVC REST webservice method which is given below.

I have implemented client-side javascript validation but I also need server-side validation for security reasons (someone could for example use a REST client in order to send arbitrary data to my webservice method).

@RequestMapping(value = "/{id}", method = PUT, produces = "application/json")
public Curriculum updateCurriculum(@PathVariable("id") Long curriculumId, @RequestBody @Validated({ ValidationGroups.CurriculumUpdate.class }) Curriculum curriculum,
        BindingResult bindingResult, HttpServletResponse response, @CurrentMember Member member) {
    if (bindingResult.hasErrors()) {
        return curriculum;
    }
    return curriculumService.updateCurriculum(member, curriculumId, curriculum);
}
  1. My first question is what do I return to the client - if anything - should there be server-side validation errors picked up by my JSR 303 implementation (such as a missing datum in the curriculum object for example). As of now I return the Curriculum object as it was received by the server from the client.
  2. My second question is what HTTP status should I return to the client (in the response) in case of server side errors?
  3. And more broadly, does the above code follow REST best practices as far as dealing with data received by the server? Can it be improved?
balteo
  • 23,602
  • 63
  • 219
  • 412
  • possible duplicate of [REST HTTP status codes for failed validation or invalid duplicate](http://stackoverflow.com/questions/3290182/rest-http-status-codes-for-failed-validation-or-invalid-duplicate) – Raedwald Dec 17 '14 at 13:20
  • Please note that my question is not only about the HTTP status but also about what is returned by the method and REST best practices. – balteo Dec 17 '14 at 13:31
  • @Raedwald: if you wish to close my post, then first provide an answer to the first and third of my questions as the link you provide only deal with my second question! – balteo Dec 17 '14 at 15:31
  • If you have 3 questions, ask 3 questions not one. – Raedwald Dec 17 '14 at 15:32
  • It now comes down to common sense: one can see the three questions are all tightly related. Consider it a threefold question. – balteo Dec 17 '14 at 15:47

0 Answers0