Validate Additional parameters in Requestbody for Springboot request and throw 400

Question

@Data
public class Employee{
@NotNull
@NotBlank
private string id;

@NotNull
@NotBlank
private string name;
}

@RestController
@Validated
class EmployeeController{

@postMapping(consumes="json", produces="json")
public ResponseEntity getEmployee(@Valid @RequestBody Employee){
 return response;
}

}

Added Exceptional Handler with MethodArgumentNotvalidException.

positive Validation works fine, Whenever we check with id & name.

Expectation is, if we add any additional parameters along with id and name, it should throw the 400

sample input : { "abc":"xyz", "id":"09e240", "name":"Billa" }

Expected Output : 400 bad request

Answer 1

The validation doesn't occur until after the deserialization into the Employee object has occurred; therefore, I don't believe you can do this with the validation API.

What you want to do is force the deserialization to fail on unknown properties. Create a bean of type ObjectMapper and configure it to fail deserialization when it encounters unknown properties.

@Bean
public ObjectMapper objectMapper() {
    ObjectMapper objectMapper = new ObjectMapper();
    objectMapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, true);

    return objectMapper;
}

This will throw an UnrecognizedPropertyException, then you can use ControllerAdvice to map this to a 400. By the way, I suspect that you have already created this bean somewhere as the default behavior for ObjectMapper is set to FAIL_ON_UNKNOWN_PROPERTIES -> true.

The controller advice to map the UnrecognizedPropertyException will look like this:

import com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.bind.annotation.ExceptionHandler;


@ControllerAdvice
public class Advice {

    @ExceptionHandler(UnrecognizedPropertyException.class)
    public ResponseEntity<?> handleDeserializationErrors(UnrecognizedPropertyException unrecognizedPropertyException) {
        return ResponseEntity.badRequest().body(unrecognizedPropertyException.getMessage());
    }
}