Whose responsibility is it to check data validity?

Question

I am confused as to whether it is the caller or the callee's responsibility to check for data legality.

Should the callee check whether passed-in arguments should not be null and meet some other requirements so that the callee method can execute normally and successfully, and to catch any potential exceptions? Or it is the caller's responsibility to do this?

Answer 1

Both consumer side(client) and provider side(API) validation.

Clients should do it because it means a better experience. For example, why do a network round trip just to be told that you've got one bad text field?

Providers should do it because they should never trust clients (e.g. XSS and man in the middle attacks). How do you know the request wasn't intercepted? Validate everything.

There are several levels of valid:

1. All required fields present, correct formats. This is what the client validates.
2. # 1 plus valid relationships between fields (e.g. if X is present then Y is required).
3. # 1 plus # 2 plus business valid: meets all business rules for proper processing.

Only the provider side can do #2 and #3.