How to validate the size of @RequestParam of type List

Question

I'm creating a Spring-Boot microservice REST API that expects @RequestParam of type List<String>. How can I validate that the list contains a minimum and a maximum amount of values?

So far I've tried using @Size(min=1, max=2) which is supposed to support collections as well (javax.validation.constraints.Size).

I also tried adding @Valid and a BindingResult parameter along with the @Size annotation without success.

I'd prefer using a solution similar to the first example using @Size(min=1, max=2) which is more compact and neat. This is for Spring-Boot 2.1.2.RELEASE.

@RestController
public class MyApi {

    @GetMapping(value = "/myApi", produces = { APPLICATION_JSON_VALUE })
    public ResponseEntity<List<MyObject>> getSomething(@Valid @RequestParam(value = "programEndTime", required = false) @Size(min = 1, max = 2) List<String> programEndTime, BindingResult result) {
        if (result.hasErrors()) {
            System.out.println("Error");
        } else {
            System.out.println("OK");
        }
    }
}

I expect the System.out.println("Error") line to be reached but it's actually skipped.

Answer 1

If you're using method argument validation, you should annotate your controller with @Validated, as mentioned by the documentation:

To be eligible for Spring-driven method validation, all target classes need to be annotated with Spring’s @Validated annotation. (Optionally, you can also declare the validation groups to use.) See the MethodValidationPostProcessor javadoc for setup details with the Hibernate Validator and Bean Validation 1.1 providers.

That means you should change your code to:

@Validated // Add this
@RestController
public class MyApi {
    // ...
}

After that, it will throw a ContraintViolationException if the validation doesn't match.

Be aware though, since you only have a @Size() annotation, if you don't provide a programEndTime, the collection will be null and that will be valid as well. If you don't want this, you should add a @NotNull annotation as well, or remove the required = false value from @RequestParam.

You can't use the BindingResult though to retrieve the errors, as that only works for model attributes or request bodies. What you can do, is define an exception handler for ConstraintViolationException:

@ExceptionHandler(ConstraintViolationException.class)
public void handleConstraint(ConstraintViolationException ex) {
    System.out.println("Error");
}