We have an "informal" specification that lists the different REST operations, and describes the "beans" that are passed in/out. On the java side, we have different bean classes, and we use gson to turn the incoming JSON strings into Java objects.
Lately, I figured that our current setup on the Java side ignores bean fields that are unknown. So when the JS side provides a field that gson can't map to a Java bean class field, nothing happens.
On the one hand, this behavior seems convenient, for example it enables the JS side to do this:
- calling a GET from the backend, receiving an instance of some X bean
- adding other information to that object, to then send use it as Y bean on some PUT request
On the other hand, from the statically typed backend point of view, it just feels wrong to ignore incoming data.
My question: are there specific best practices or patterns that apply here? Are there good technical arguments to always allow "unknown" fields, or to always forbid them, and "fail" requests using unknown fields?