Validating client data

Web services cannot trust the data that is received from clients and are subject to the same kinds of issues that affect HTML forms. Malicious users can craft HTTP requests or alter the client-side JavaScript code to send data values that will cause errors or create unexpected results, similar to the problems with form data described in Chapter 11.

The difficulty with web services is validating data in a way that doesn’t undermine the code clarity that came from isolating the statements that handle HTTP requests. If every web service method validates its data directly, the result is a mess of duplicated code statements that bury the web service functionality and are difficult to read and entertain. The best approach to validation is to describe validation requirements and apply them outside of the web service.

Creating the validation infrastructure

Allowing the validation requirements of a web service to be expressed clearly and concisely...