168 votes
Accepted

If functions have to do null checks before doing the intended behaviour is this bad design?

The problem with your basic example isn't the null check, it's the silent fail. Null pointer/reference errors, more often than not, are programmer errors. Programmer errors are often best dealt with ...
whatsisname's user avatar
  • 27.7k
68 votes
Accepted

Is it common practice to validate responses from 3rd party APIs?

Absolutely. For starters, you never know that somebody hasn't hacked into your connection and the reply you receive doesn't come from the API at all. And some time in the last two weeks I think ...
gnasher729's user avatar
  • 45.1k
59 votes

Is it ok to have validation layer before access control layer

It depends on whether knowing the validity of some input for a task that you aren't permitted to do is a security leak. If it is, you really should to do it the other way round. The only safe ...
Caleth's user avatar
  • 10.9k
55 votes

If functions have to do null checks before doing the intended behaviour is this bad design?

Since _someEntity can be modified at any stage, then it makes sense to test it every time that SetName is called. After all, it could have changed since the last time that method was called. But be ...
David Arno's user avatar
  • 39.3k
53 votes
Accepted

Should I throw an exception in case of a meaningful value outside of the range or handle it myself?

If the core of your question is this... If some client code passes an argument whose value is invalid for the thing that my data structure is modeling, should I reject the value or convert it to ...
Theodoros Chatzigiannakis's user avatar
53 votes
Accepted

Clean architecture validation in domain vs data persistence layer?

Validation of data entry is one of those things where everyone starts out trying to make it pure and clean and (if they're smart about it) eventually gives up, because there are so many competing ...
John Wu's user avatar
  • 26.5k
43 votes

Is it common practice to validate responses from 3rd party APIs?

Somebody else's API is your external interface. You shouldn't blindly trust anything that crosses that boundary. Your future debuggers will thank you for not propagating the other system's errors ...
Ross Patterson's user avatar
25 votes

Is it ok to have validation layer before access control layer

Well, there are multiple types of validation: Cheap basic sanity-checking, which verifies that the request is not obviously malformed. This is typically at least partially duplicated client-side, to ...
Deduplicator's user avatar
  • 9,031
23 votes

If functions have to do null checks before doing the intended behaviour is this bad design?

But should the method not have this check? This is your choice. By creating a public method, you are offering the public the opportunity to call it. This always comes along with an implicit contract ...
null's user avatar
  • 3,566
20 votes

Is it a bad idea to do validation in the constructor?

You should do validation in a constructor, to the extent that it is necessary to ensure that your constructor can stand up a viable object. This is especially true of any dependencies or data you hand ...
Robert Harvey's user avatar
20 votes

How to ensure data consistency in system with multiple databases?

There are no easy solutions. Distributed consistency is fundamentally difficult, with some hard limits to what is possible. See the CAP theorem and Fallacies of distributed computing. And doing ...
JonasH's user avatar
  • 4,833
17 votes

In which layer should validation be located?

Both controller layer and service layer expose certain interfaces. Interfaces define contracts on how the interface should be used. Contract usually means which arguments (and its types and values) ...
qbd's user avatar
  • 2,916
17 votes

Is it common practice to validate responses from 3rd party APIs?

Is your API-boundary also a trust-boundary? As you are communicating with a remote system, that's nearly a certainty. Even if the remote system itself might be trusted, the medium might not be. ...
Deduplicator's user avatar
  • 9,031
15 votes

Is it ok to have validation layer before access control layer

There must be some validation before access control. Let's say SO's API has an endpoint "edit answer", then whether the user can edit a particular answer can depend on the answer (below a certain ...
Sebastian Redl's user avatar
14 votes

If functions have to do null checks before doing the intended behaviour is this bad design?

The other answers are good; I'd like to extend them by making some comments about accessibility modifiers. First, what to do if null is never valid: public and protected methods are those where you ...
Eric Lippert's user avatar
  • 46.2k
12 votes

Name validation best practices

No, it's not sensible to try to implement these restrictions. There's many flaws, lots of which are enumerated in Falsehoods programmers believe about names For example; People’s names are written ...
Daenyth's user avatar
  • 8,127
12 votes
Accepted

Should a backend Restful API implement data validation

yes, data can be always manipulated on a client side or in transfer. you can NEVER depend on a client side validation. client side is a hacker computer side, so not safe at all. client side validation ...
rsm's user avatar
  • 302
11 votes
Accepted

Why is it bad to use exceptions for handling this type of validation? It seems like it makes the code so much cleaner

The first issue I have with using exceptions for validation is that I would typically expect the outcome of the validation to potentially churn up multiple errors with the same data. Exceptions are ...
Ben Cottrell's user avatar
  • 11.7k
10 votes

Should I throw an exception in case of a meaningful value outside of the range or handle it myself?

It depends a lot. But you should decide to do something and document it. The only definitively wrong thing for your code to do is to forget to consider that user input might be outside the expected ...
Ben's user avatar
  • 1,027
9 votes

How to perform input validation without exceptions or redundancy

As an extension to @amon's answer, we can combine his EvenInteger with what the functional programming community might call a "Smart Constructor" -- a function that wraps the dumb constructor and ...
walpen's user avatar
  • 3,231
9 votes

Centralize input validation across multiple Microservices

If the microservices are written in the same language (or languages which can use libraries in a common language) it makes most sense to define a validation library and import it in the various ...
Hans-Martin Mosner's user avatar
8 votes
Accepted

Writing a valid test case for validating XMLs

To validate an XML file, you first need an XML Schema Definition (XSD) that describes the structure of a valid XML document. You can find the specification for XSD files at W3C. Going into how to ...
Adam Zuckerman's user avatar
8 votes
Accepted

Data validation: separated class or not?

It is OK to delegate any logic by means of composition if that logic is going to change dynamically during the execution of a program. Complex validations like the ones you explain are as good a ...
Tulains Córdova's user avatar
8 votes
Accepted

How to perform input validation without exceptions or redundancy

In the case of your example, the best solution is to use a more general padding function; if the caller wants to pad to an even size then they can check that themselves. public static String ...
amon's user avatar
  • 134k
8 votes
Accepted

Are periodic validation or verification tests required after the software is released?

It does not seem to make much sense to run the exactly same set of tests against the exactly same, unchanged piece of software once a year, as long as the software runs on a reliable, unchanged ...
Doc Brown's user avatar
  • 207k
8 votes

If functions have to do null checks before doing the intended behaviour is this bad design?

The other answers point out that your code can be cleaned up to not need a null check where you have it, however, for a general answer on what a useful null check can be for consider the following ...
Paddy's user avatar
  • 2,623
8 votes
Accepted

Formatting a string by converting to a number then back to a string

Personally I think the first one looks more readable. It make really clear what's the expected output. The second one may take some more effort. By the way, what happens if the number does not fit ...
Matteo Ugolotti's user avatar
8 votes

DDD - How to do informative validation (specifically on entity creation)?

This is a question I have been asking myself and doing research for quite some time now. Below are a couple of ways you could be telling the caller of your constructors/methods what went wrong during ...
Ciprian Vilcan's user avatar
8 votes

Why is it bad to use exceptions for handling this type of validation? It seems like it makes the code so much cleaner

It seems to me that in your example the two exceptions are exceptional. ie. you don't expect them to be thrown very often. The problem with the overall pattern is usually you DO expect validation ...
Ewan's user avatar
  • 75.6k
8 votes
Accepted

Should I cache database requests made in validation layer?

It sounds like you have a problem with the "API" first approach (not the design pattern, but the knowledge of the infrastructure). If you forget that you have an API, how would you handle ...
Blaž Mrak's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible