Mastering Elegant Parameter Validation with Hibernate Validator

Parameter validation is essential to protect code; developers often write repetitive if‑else checks. This article explores how to implement elegant validation in business systems and shares practices for building a reusable validation module.

1. Hibernate Validator

JSR‑303 defines a Bean Validation API (javax.validation.constraints). By annotating fields or method parameters with @NotNull, @Email, etc., validation can be delegated to third‑party frameworks. Hibernate Validator is the reference implementation, independent of Hibernate ORM, and integrates with Spring MVC.

After integrating the validation API, simple checks become trivial, as shown in the diagrams.

Hibernate Validator supports basic constraints such as @Email, @NotNull, @Pattern, @AssertFalse, etc. For business‑specific checks (e.g., order ID existence), custom annotations can be defined and registered via SPI.

2. Implementation Principle

The core idea is to read class metadata, locate annotated properties, and at validation time evaluate each constraint, collecting violation messages. Hibernate Validator follows this approach.

The validation process involves initializing non‑lazy components, parsing class data, invoking the appropriate validator for each property, and using MessageInterpolator to produce localized messages.

3. Elegant Practices

Based on Hibernate Validator, the article suggests practices to decouple business logic from validation:

Intercept all requests using RPC filters or Spring MVC HandlerInterceptor; invoke the validator and return failure quickly.

Create a unified validation package exposing annotation‑based APIs (e.g., @NotNull, @ExistItem) for reuse across services.

Provide implementations of custom validators as a shared Maven dependency.

Extend Hibernate Validator to load error messages from a configuration center, allowing runtime updates.

Package the solution as a starter for easy integration.

4. Sample Code

// Initialize validator with custom ResourceBundle
public static Validator validator;
static {
    HibernateValidatorConfiguration configure = Validation.byProvider(HibernateValidator.class).configure();
    ResourceBundleLocator defaultLocator = configure.getDefaultResourceBundleLocator();
    ResourceBundleLocator myLocator = new MyResourceBundleLocator(defaultLocator);
    configure.messageInterpolator(new ResourceBundleMessageInterpolator(myLocator));
    configure.enableTraversableResolverResultCache(false);
    validator = configure.buildValidatorFactory().getValidator();
}

// RPC filter: return error quickly on validation failure
String message = collectValidateMessage(args);
if (StringUtils.isNotEmpty(message)) {
    RPCResult rpcResult = new RPCResult();
    rpcResult.setHsfResponse(new HSFResponse());
    rpcResult.setAppResponse(mockResponse(invocation, message));
    SettableFuture<RPCResult> defaultRPCFuture = Futures.createSettableFuture();
    defaultRPCFuture.set(rpcResult);
    return defaultRPCFuture;
}

5. Defensive Programming Principles

The article concludes with seven defensive programming rules from Steve McConnell’s “Code Complete”, emphasizing input validation, error handling strategies, assertions, diagnostics, standardized error handling, and judicious use of exceptions.