Bean Validation (JSR 380)

Bean Validation (JSR 380) is a Java standard for validating objects using annotations like @NotNull, @Email, and @Size. In Spring Boot, it’s implemented via Hibernate Validator and triggered with @Valid in controllers. If validation fails, Spring automatically returns a 400 Bad Request, preventing invalid data from reaching the business logic.

What is Bean Validation?

Bean Validation allows you to define rules directly on fields or methods, eliminating the need for manual if-else checks.

• Implemented in Spring Boot using Hibernate Validator (default).
• Ensures clean, consistent, and maintainable validation across the application.

Why Bean Validation is Important

• Ensures data correctness
• Prevents invalid or malicious input
• Reduces boilerplate validation code
• Protects business logic and database
• Provides automatic error handling

How Bean Validation Works in Spring Boot

Validation Flow

• @Valid triggers validation on DTO or model fields.
• Spring checks all constraints automatically.
• If validation fails → 400 Bad Request.
• If validation passes → controller executes normally.

Common Bean Validation Annotations

Bean Validation is used to validate user input or request data in Java and Spring Boot applications.

Spring Boot integrates Hibernate Validator by default, making it easy to enforce rules on DTOs, entities, or request objects.

Basic Constraints

Numeric Constraints

Date Constraints

Practical Example: DTO Validation

DTO Validation indicates a real-world demonstration of how to apply validation rules on a DTO (Data Transfer Object) in Spring Boot. It shows how annotations like @NotBlank, @Email, and @Min are used to ensure incoming data meets specific requirements before processing.

publicclassUserDTO {

@NotBlank(message = "Name is required")
private String name;

@Email(message = "Invalid email address")
private String email;

@Min(value = 18, message = "Age must be at least 18")
privateint age;

// Getters and Setters
public StringgetName() {
return name;
    }

publicvoidsetName(String name) {
this.name = name;
    }

public StringgetEmail() {
return email;
    }

publicvoidsetEmail(String email) {
this.email = email;
    }

publicintgetAge() {
return age;
    }

publicvoidsetAge(int age) {
this.age = age;
    }
}

Controller Using @Valid

@RestController
@RequestMapping("/users")
publicclassUserController {

@PostMapping
public ResponseEntity<User>createUser(@Valid@RequestBody UserDTO userDTO) {
UsersavedUser= userService.saveUser(userDTO);
return ResponseEntity
                .status(HttpStatus.CREATED)
                .body(savedUser);
    }
}

What happens:

• @Valid triggers all validation rules defined in UserDTO.
• If any rule fails → Spring automatically returns 400 Bad Request with error details.
• If all rules pass → the controller executes normally and returns the saved user.

@Valid

• Part of JSR-380 / javax.validation standard.
• Used for basic validation of request bodies or method parameters.
• Works with Spring MVC or Spring WebFlux controllers.
• Cannot handle validation groups.

Example:

@PostMapping("/users")
public ResponseEntity<User>createUser(@Valid@RequestBody UserDTO userDTO) {
return ResponseEntity.ok(userService.saveUser(userDTO));
}

@Validated

• Spring-specific annotation (org.springframework.validation.annotation.Validated).
• Extends @Valid functionality.
• Supports validation groups for conditional validation.
• Can also be used on classes, not just method parameters.

Example with validation group:

@PostMapping("/users")
public ResponseEntity<User>createUser(
@Validated(OnCreate.class)@RequestBody UserDTO userDTO) {
return ResponseEntity.ok(userService.saveUser(userDTO));
}

Difference Between @Valid vs @Validated

Custom Bean Validation

Custom Bean Validation allows you to define your own validation rules when the built-in annotations like @NotNull or @Email are not sufficient. You create a custom annotation (e.g., @StrongPassword) and implement a validator class (like PasswordValidator) that contains the logic to check the rule.

This is useful for complex validations such as password strength, ID formats, or business-specific rules.

Example annotation:

@Constraint(validatedBy = PasswordValidator.class)
@Target({ FIELD })
@Retention(RUNTIME)
public@interface StrongPassword {
    Stringmessage()default"Weak password";
    Class<?>[] groups()default {};
    Class<?extendsPayload>[] payload()default {};
}

• @Constraint(validatedBy = ...) → Specifies the validator class that implements the logic.
• message → Default error message if validation fails.
• groups → For grouping validations (used with @Validated).
• payload → For custom metadata (optional).

This annotation can then be used on fields in a DTO:

publicclassUserDTO {
@StrongPassword
private String password;
}

When used with @Valid, Spring Boot automatically triggers your custom validation.

Handling Validation Errors

When validation fails in Spring Boot (using @Valid), it throws MethodArgumentNotValidException and returns 400 Bad Request by default. You can customize responses using @ControllerAdvice, @ExceptionHandler, and custom error DTOs for consistent, user-friendly messages.

Example:

@ControllerAdvice
publicclassGlobalExceptionHandler {

@ExceptionHandler(MethodArgumentNotValidException.class)
public ResponseEntity<ErrorResponse>handleValidationExceptions(
            MethodArgumentNotValidException ex) {

        List<String> errors = ex.getBindingResult()
                                .getFieldErrors()
                                .stream()
                                .map(err -> err.getDefaultMessage())
                                .collect(Collectors.toList());

ErrorResponseresponse=newErrorResponse(LocalDateTime.now(),400, errors);
returnnewResponseEntity<>(response, HttpStatus.BAD_REQUEST);
    }
}

Best Practices

• Use DTOs, not entities, for validation
• Keep validation rules close to data
• Always validate API input
• Use meaningful validation messages
• Combine Bean Validation with global exception handling

Conclusion

Bean Validation (JSR 380) is the foundation of validation in Spring Boot. Using annotation-based rules with @Valid or @Validated:

• Ensures automatic, reliable validation
• Returns clean error responses
• Results in safer, maintainable, and production-ready APIs.