I am creating an API strcutured web application and in this application we have different layers which are doing their own job.
First layer is Validation layer which validate user input and if it passes the validation we move that to second layer (which is Access Control layer ) otherwise return the error message
Second layer is Access Control which checks if user has permission to perform the task it wants to perform, If user has permission it moves the request to next layer otherwise return error message
Third Layer is Controller Layer where we have the logic of application
My question is that is that ok to have validation layer before access control ? What if user are trying to perform a task which user doesn't have permission to and we are sending back validation error message ? User would be sending requests to an endpoint and talking with validation layer and once it passes the validation only then he would see the message
You can't access this!
It feels strange to me so is it fine like this or what could be my other options in infrastructure this?