Spring MVC and WebFlux docs need to say method validation applies if any method parameter has constraint annotations

[dreis2211]

Hi,

when upgrading to Spring-Boot 3.2.2 and therefore SF 6.1.3 we noticed a change in behaviour that causes one of our @ExceptionHandlers not to be triggered anymore, when the @RequestBody fails validation (in this case when Body#target is null).

	@PostMapping(value = "hello", produces = MediaType.TEXT_PLAIN_VALUE)
	public String hello(@RequestBody @Valid @NotNull Body body) {
		return "Hello " + body.target;
	}

	@ResponseStatus(HttpStatus.BAD_REQUEST)
	@ExceptionHandler(MethodArgumentNotValidException.class)
	public Map<String, String> handleValidationExceptions(MethodArgumentNotValidException ex) {
		System.out.println(ex.getMessage());
		Map<String, String> errors = new HashMap<>();
		ex.getBindingResult().getAllErrors().forEach((error) -> {
			String fieldName = ((FieldError) error).getField();
			String errorMessage = error.getDefaultMessage();
			errors.put(fieldName, errorMessage);
		});
		return errors;
	}

	public static class Body {

		@NotNull
		@Valid
		private String target;

		public Body() {}

		public void setTarget(String target) {
			this.target = target;
		}
	}

Interestingly, this can be worked around by removing the @NotNull from the method parameter.

I think this is somewhat related to #31711 but without the indication that the fix causes the additional annotations not to work anymore or respectively breaking the validation somehow if present.

I've created a minimal reproducer under https://github.com/dreis2211/method-argument-validation-bug to ease testing. Rolling back to SB 3.2.1 fixes it, similar to removing the @NotNull annotation. I'd appreciate if this is either fixed or explicitly documented. Use cases with List request bodies in combination with a @NotEmpty seem to be unaffected because they don't seem to throw a MethodArgumentNotValidException in the first place (also with SB 3.2.1).

In case the @NotNull annotation is not supported under certain circumstances, feel free to turn this into a documentation issue.

Let me know if you need anything.
Cheers,
Christoph

[quaff]

		@NotNull
		@Valid
		private String target;

You should remove @Valid here.

[dreis2211]

@quaff without @Valid no validation happens at all.

[ChrAh88]

I think instead of MethodArgumentNotValidException the HandlerMethodValidationException is thrown.

Is your Controller annotated with @Validated? If not, can you try it?

[dreis2211]

@ChrAh88 Class-level @Validated + method level @Valid would also work. It's not so much about strategies on how to workaround the issue. In my case I can also remove the @NotNull and it works likewise - as stated above.

Method validation on SF 6.1 should not need the @Validated anymore to apply method level validation, anyway.

As said. I'm also totally fine with having this as a documentation-only issue, but it clearly needs clarification what is supported and what is not.

[crazyav1]

Same issue after update to 6.1.3 instead of MethodArgumentNotValidException the HandlerMethodValidationException is thrown.

[quaff]

@quaff without @Valid no validation happens at all.

According to the Javadoc, @Valid should be used for nested property, obviously String is not.

Have you tried to remove @NotNull from method parameter and @Valid from field?

	public String hello(@RequestBody @Valid /*@NotNull*/ Body body) {
		return "Hello " + body.target;
	}
	public static class Body {

		@NotNull
		/*@Valid*/
		private String target;

		public Body() {}

		public void setTarget(String target) {
			this.target = target;
		}
	}

[quaff]

Same issue after update to 6.1.3 instead of MethodArgumentNotValidException the HandlerMethodValidationException is thrown.

I think it's expected if you remove @Validated from class level then built-in web method validation will be used, see #30645.
@dreis2211 Can you confirm that HandlerMethodValidationException is triggered instead of MethodArgumentNotValidException with your case?

[crazyav1]

@Validated requirement seems like breaking change to me, but I don't find this mentioned anywhere . And if you try to find any tutorial on @valid everyone is excpecting MethodArgumentNotValidException.

[dreis2211]

@quaff HandlerMethodValidationException is thrown. With a slightly adjusted error handler this would also work.

I don't want to repeat myself, but if this is a documentation-only issue I'm totally fine with that. But I think it needs documentation what the preferred way is and what is not supported.

[ChrAh88]

@dreis2211 it's documented here: https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-controller/ann-validation.html
Second, if Java Bean Validation is present AND other method parameters, e.g. @RequestHeader, @RequestParam, @PathVariable have @constraint annotations, then method validation is applied to all method arguments, raising HandlerMethodValidationException in case of validation errors.

With the fix of #31711, also SmartValidators with contained jakarta validator are respected. In case of spring boot the validator "ValidatorAdapter" is a SmartValidator with a contained jakarta validator.

But yes, spring boots upgrade instructions to version 3.2 or the release notes for 3.2.2 should be updated in my opinion.
https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-3.2-Release-Notes#upgrading-from-spring-boot-31

[crazyav1]

@ChrAh88 From documentation it seems that if only @Valid @RequestBody SomeBody body is used in method parameters, the only MethodArgumentNotValidException is raised, and then we add some other annotation to other parameter,e.g. @Valid @RequestBody SomeBody body, @NotNull @RequestParam Param param will raise HandlerMethodValidationException even if validation error still in body?

[rstoyanchev]

@ChrAh88 thanks for the analysis, which is spot on. And @crazyav1 you're right that the documentation needs a little update since method validation applies if any method parameter has constraint annotations.

[dreis2211]

@rstoyanchev What is your recommendation for the use-case at hand? Dropping the @NotNull, changing the @ExceptionHandler (aka creating a duplicated one for HandlerMethodValidationException) or using @Validated or a combination of things?

[rstoyanchev]

@dreis2211, I would suggest dropping the @NotNull since @RequestBody has a required flag, but generally both exceptions could arise from controller methods and should be handled in some global @ExceptionHandler method like an @ControllerAdvice extension of ResponseEntityExceptionHandler.

[dreis2211]

Thanks. Exactly what I was hoping for (because I did it already :D )