Eingaben validieren
Bean Validation mit @Valid und Constraint-Annotationen und wie man Fehler in hilfreiche Antworten verwandelt.
Deutsche Übersetzung in Arbeit
Diese Lektion ist noch nicht ins Deutsche übersetzt und wird daher auf Englisch angezeigt. Der Rest der Seite ist vollständig lokalisiert.
Auf dieser Seite
Never trust input. A client might POST a book with a blank title, a negative copy count, or a malformed ISBN. Checking every field by hand in every controller is tedious and easy to get wrong. Bean Validation lets you declare the rules once, as annotations, and have Spring enforce them automatically.
Add the starter
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-validation</artifactId>
</dependency>Declare constraints on the DTO
Annotate the request record's components with constraints:
record CreateBookRequest(
@NotBlank @Pattern(regexp = "\\d{3}-\\d{10}", message = "must be an ISBN-13")
String isbn,
@NotBlank @Size(max = 200)
String title,
@NotBlank
String author,
@Min(1) @Max(1000)
int copies
) {}Common constraints: @NotNull, @NotBlank, @Size, @Min/@Max, @Email,
@Pattern, @Positive. Each carries an optional message.
Trigger it with @Valid
A constraint annotation does nothing until you ask Spring to validate. Add @Valid to
the @RequestBody parameter:
@PostMapping
ResponseEntity<BookResponse> add(@Valid @RequestBody CreateBookRequest request) {
// reached only if `request` is valid
...
}If validation fails, Spring throws MethodArgumentNotValidException before your
method runs - the invalid data never reaches your logic. By default that becomes a
400 Bad Request. In the next lesson you'll shape that into a helpful error body.
Your controller is the club; the guests are incoming requests. A bouncer checks
IDs at the door so nobody underage ever gets inside - the club staff never have to
worry about it. @Valid is that bouncer: bad requests are turned away at the
boundary, so your business logic only ever deals with data it can trust.
Validate at the edge, trust within
Do validation once, at the web boundary. Everything past a validated @RequestBody can
assume the data is well-formed, so your service and domain code stay free of defensive
null checks and re-validation.
BookVault's CreateBookRequest must reject: a blank title, an ISBN that isn't 13
digits in the NNN-NNNNNNNNNN form, and a copies value below 1. Which constraint
annotation handles each, and what one annotation on the controller parameter makes
Spring enforce them?
What makes Spring actually enforce a DTO's @NotBlank/@Size constraints on a request body?
Key takeaways
- Bean Validation declares input rules as annotations (@NotBlank, @Size, @Min, @Pattern…) on DTO fields.
- spring-boot-starter-validation enables it.
- @Valid on a @RequestBody parameter triggers validation; failures throw MethodArgumentNotValidException (a 400) before your method runs.
- Validate once at the web boundary so downstream code can trust its inputs.
- Each constraint can carry a custom message for clearer error responses.