Backend validation - a complete example

[Mike Ottinger]

Hi Guys,

I've finally succeeded in getting errors added to the BindException object in my controller's onSubmit method, and having them rendered on my jsp page via the spring:hasBindErrors tag. I have to say this was not an easy task, I gathered snippets of information about doing this from various websites and my Expert Spring MVC book, no one single source had a complete example. So I thought I might show the process I took and I'd love to hear feedback on whether I'm taking the right tack on this:

My controller:

...
if(!badUsername) {
  bindException.reject("errors.invalid", new Object[] {"User"}, "");      
  return showForm(request, response, errors);
}
...

My controller overrides onSubmit(request, response, object, bindException). If the username is invalid, then an error is added to bindException and showForm is called to return the form to the user. To control the clearing of the form when re-displaying it, I overrode referenceData(request, command, errors):

  
 
log.info("In referenceData");
      
BindException be = (BindException)errors;
Map originalModel = be.getModel();
UserBean originalUser = (UserBean)originalModel.get("user");
originalUser.setEmail(null);
originalUser.setPassword(null);
      
return originalModel;
 

I had to cast to a BindeException in order to get at the original model that was created. With this, I pulled out my UserBean object and cleared the fields.
Finally my JSP page:

  
 
<spring:nestedPath path="user">
 <form action="" method="post">
   <spring:bind path="email">
     <input type="text" name="${status.expression}" value="${status.value}">
   </spring:bind>
   <spring:bind path="password">
     <input type="password" name="${status.expression}" value="${status.value}">
   </spring:bind>
     <input type="submit" value="Log In">
 </form>
</spring:nestedPath>
   
<spring:hasBindErrors name="user">
  <p>There were ${errors.errorCount} errors</p>
  <c:forEach var="err" items="${errors.allErrors}">
    <spring:message code="${err.code}" arguments="${err.arguments[0]}"/>
  </c:forEach>
</spring:hasBindErrors>
 

This was pretty standard, the only part I thought was a little awkward was in how I had to place a spring:message lookup for the errorcode along with its argument, I thought the error objects would have this error desription ready for my at the point.
I think the part I got stumped on the most was how I had to get at the model through the bindException object in my referenceData method. Simply creating and returning a new Map with the same "user" key mapped to a new UserBean object didn't seem to work, because this new Map would be merged with the existing model object using addAll and it wouldn't overwrite the first object keyed off of "user".
Does the above look appropriate for handling logical validation in a controller?

Thanks for the help

[Henry Lowell]

Holy cow! All that just to show some errors on the JSP? Spring MVC at it's finest.

[Mike Ottinger]

Yeah I know. I'm a huge fan of Spring, I really want Spring MVC to work, but it's 5 times easier to do this with a forward tag in struts. Maybe that's why I struggled with this, because I was looking for the "forward tag" equivalent with Spring. It very well could be that the "perfect" MVC framework out there is struts + spring. I think I'm going to open a can of worms with that statement, but some frameworks do a better job at certain tasks than others.

[Jordi Monn�]

More info here: http://www.salixalba.uklinux.net/willow/computing/spring.html

[BLUE COW]

hi! Mike / Jordi,

I am trying to do the same thing userid / password validation using spring MVC without much success. I am new to Spring. I have to check whether username/passwd is present in the database and get back to the form if there is error or go to the success view(displayMenu.jsp). Can you guys help me with this?
My questions: where do you check that username and password exists in the database or not? In the validator or controller? Now you are checking

if(!badUsername) {
bindException.reject....
...
}

Is badUsername being set in the validator or controller?

Thanks! Anyway this posting was very helpful to me in the first case....


blue

[Peter Oxenham]

In response to BLUE COW:

The quick answer to you question is 'either'. You can do it in a Validator or the controller.

If you don't want to create a validator, then override the onBindAndValidate method of BaseCommandController.

Simply do your check there (via your DAO) and call reject on the BindException if the username is bad.

Mike:
I recommend the same to you. Do your check for badUsername in onBindAndValidate and if you do add an error then SimpleFormController will automatically display your formView for you. You could also blank out the email and password fields at that point, instead of in referenceData.

[Junilu Lacar]

"BLUE COW"

Please change your publicly displayed name so that it conforms with the JavaRanch Naming Policy. You can change it here.
Thanks for your cooperation.

[Elie Hirschman]

Jordi Monn� wrote:More info here: http://www.salixalba.uklinux.net/willow/computing/spring.html

Even though this is a really old post, it came up for me when I was googling for the right way to output errors in a jsp.
There is a "Correction" at the bottom of that post, which clarifies that you can do this the easy way, like so:

  <spring:bind path="user">
<font color="red"><c:out value="${status.errorMessage}"/></font>
</spring:bind>  

[Vishwanath Krishnamurthi]

Hi,

thanks for bringing this thread up...

I found the one thing that was keeping my code from working, in this thread

I was using

showForm()
instead of
return showForm()

----------------------------------------------------------------------------------------------------------------------------------------
This is my code. If anyone's trying this part.

The controller:

package springapp.web;

import org.springframework.web.servlet.mvc.SimpleFormController;
import org.springframework.web.servlet.ModelAndView;
import org.springframework.web.servlet.view.RedirectView;

import org.apache.log4j.Logger;
import org.apache.log4j.BasicConfigurator;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.web.context.support.WebApplicationContextUtils;
import org.springframework.web.context.WebApplicationContext;

import org.springframework.validation.BindException;

import springapp.domain.User;
import springapp.persistence.AccountDao;
import java.util.*;


public class RegController extends SimpleFormController
  {

      User user;
      WebApplicationContext context;
      static Logger logger = Logger.getLogger(RegController.class);
        
      public ModelAndView onSubmit(HttpServletRequest req, HttpServletResponse resp,Object command,BindException errors)
            throws Exception {

            BasicConfigurator.configure();
            logger.info("==========In OnSubmit Method======");
             
            user = (User)command;
            context=WebApplicationContextUtils.getRequiredWebApplicationContext(req.getSession().getServletContext());
            AccountDao accountDao=(AccountDao)context.getBean("AccountDaoBean");

      
            logger.info("========checking username exists?======");
            if(accountDao.doesUserExist(user))
             {
                logger.info("====Username exists already====");
                errors.rejectValue("username", "field.already.exists");
               return showForm(req,resp,errors); 

              
             }
            else
             {
               logger.info("====username doesnt exist.. saving ======");
              accountDao.save(user);
              
            }
             
              return new ModelAndView(getSuccessView());
          }

              
 
 }

In the controller above I check if the username already exists or not and if it exists I use rejectValue() method that rejects the value of the username field and shows the text from the properties file (I've pasted it below) that corresponds to the key 'field.already.exists'.

Then the return showForm() method is used to show the formView again with the validation error.
(The successView and the formView are configured in the bean)

Why did I do this validation check in the Controller and not in the Validator?
-> Because I cudn't find a way to access my DAO from inside the validator.


The Validator:

package springapp.service;

import springapp.domain.User;
import springapp.persistence.*;
import springapp.exceptions.*;

import org.apache.log4j.Logger;
import org.apache.log4j.BasicConfigurator;

import org.springframework.web.context.support.WebApplicationContextUtils;
import org.springframework.web.context.WebApplicationContext;
import org.springframework.validation.*;

 public class RegistrationValidator implements Validator {
 
    private static final int MINIMUM_PASSWORD_LENGTH = 6;
    static Logger logger = Logger.getLogger(RegistrationValidator.class);

 
    public RegistrationValidator()
    {
       
    }

    public boolean supports(Class clazz) {
       return User.class.equals(clazz);
    }
 
   

    public void validate(Object obj, Errors e) {

       BasicConfigurator.configure();
       logger.info("--Inside Registration Validator--");
       User user = (User)obj;
       ValidationUtils.rejectIfEmptyOrWhitespace(e, "username", "field.required");
       ValidationUtils.rejectIfEmptyOrWhitespace(e, "password", "field.required");
       

       if (user.getPassword() != null
             && user.getPassword().trim().length() < MINIMUM_PASSWORD_LENGTH)
       {
          e.rejectValue("password", "field.min.length",
                new Object[]{Integer.valueOf(MINIMUM_PASSWORD_LENGTH)},
                "The password must be at least [" + MINIMUM_PASSWORD_LENGTH + "] characters in length.");
       }


 
   }
 }
 

What does this Validator do?

1)Checks for empty fields...
2)Is the password < 6 characters...


The Dao:

package springapp.persistence;

import springapp.domain.User;
import org.springframework.orm.hibernate3.HibernateTemplate;


import org.apache.log4j.Logger;
import org.apache.log4j.BasicConfigurator;
import org.hibernate.HibernateException;
import org.springframework.orm.hibernate3.HibernateCallback;
import org.hibernate.criterion.Restrictions;
import org.hibernate.*;

import java.sql.SQLException;

import java.util.List;

public class AccountDao
  {

   private HibernateTemplate hibernateTemplate;  
    static Logger logger = Logger.getLogger(AccountDao.class);

   public HibernateTemplate getHibernateTemplate(){
        return hibernateTemplate;
    }

   public void setHibernateTemplate(HibernateTemplate ht){
        hibernateTemplate=ht;
    }

    
  public void save(User user)throws Exception
    {
      BasicConfigurator.configure();
      logger.info("About To Save");
      this.getHibernateTemplate().save(user);         
   }
   
  public boolean doesUserExist(final User user)
    {
       List results = (List)hibernateTemplate.execute(new HibernateCallback() {
            public Object doInHibernate(Session session) throws HibernateException, SQLException {
             
                 String nameOfUser =user.getUsername();
                logger.info("=====Name of user in form submitted is======= "+nameOfUser);
                Query query=session.createQuery("from User where username=:a");
                query.setString("a",nameOfUser);
                List myList=query.list();
                logger.info("=====myList is empty?========Returning:"+myList.isEmpty()); //StatementA
                return myList;
            }
        });
         
          logger.info("===myList is empty?========Returning:"+results.isEmpty());
          return !results.isEmpty();
      }
 }

The Dao has the doesUserExists() method...
I think this check code can be done in just a few lines with a session.get(User.class,username)
but that I think would work only if username was the primary key.
In my table structure, the username was just a field with unique constraint and the pk was userid.
So I tried it this way.

Bean Config:

<bean id="AccountDaoBean" class="springapp.persistence.AccountDao">
    <property name="hibernateTemplate">
        <ref bean="hibernateTemplate"/>    
    </property>
</bean>

bean name="/registration.htm" class="springapp.web.RegController">
      <property name="sessionForm" value="true"/>
      <property name="commandName" value="register"/>
      <property name="commandClass" value="springapp.domain.User"/>
         <property name="validator">
            <bean class="springapp.service.RegistrationValidator"/>
        </property>
      <property name="formView" value="registrationForm"/>
      <property name="successView" value="registrationSuccess"/>
</bean>

The form view jsp:

<%@ include file="/WEB-INF/jsp/include.jsp" %>
<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>
<%@ include file="/WEB-INF/jsp/header.jsp" %>

<html>
<head>
  <title>Registration Form</title>
  <style>
    .error { color: red; }
  </style>  
</head>


<body>

<form:form method="post" commandName="register">
<div id="main2">
 <p >   
<table   border="0"  >
 <tr>
 <td >
  Username: <form:input  path="username" autocomplete="true" maxlength="10"/>
 </td>
 <td >
  <form:errors path="username"  cssClass="error"/>
 </td>
 <tr>
 <td >
  Password: <form:password path="password" maxlength="15"/><br>
 </td>
 <td >
  <form:errors path="password" cssClass="error" />
 </td>
 </tr>
 </table>
</p>

<p >
<input type="submit" value="Register"></p>
</div>
</form:form>
<br>

</body>
</html>

The properties file:

required=Entry required.
typeMismatch=Invalid data.
field.required=You cannot leave the field empty!
field.min.length=The password must be atleast 6 charcters in length
field.already.exists=The username already exists

HTH,
Vishwa

[Hong Anderson]

Put validation codes in Validator, you can DI Daos to Validator.

[Vishwanath Krishnamurthi]

Hi,

I would like to do it that way...
In my controller, I access getBean() as:

context=WebApplicationContextUtils.getRequiredWebApplicationContext(req.getSession().getServletContext());
            AccountDao accountDao=(AccountDao)context.getBean("AccountDaoBean");

But donno how I can access getBean() in the validator without a request attribute in any of the Validator methods.
What can I do?

Thanks,
Vishwa

[Hong Anderson]

You should use DI over dependency lookup.

Please read http://static.springframework.org/spring/docs/2.5.x/reference/index.html.

[Vishwanath Krishnamurthi]

Hi Kengkaj,

Thanks a lot !!!
I was of the thought that getBean() was the only way!
(how stupid! a few errors i got before while trying without getBean() made me think so)

This is a lot cleaner!!!

I made a few changes:

<bean id="RegistrationValidatorBean" class="springapp.service.RegistrationValidator">
  <constructor-arg> <ref local="AccountDaoBean"/> </constructor-arg>
</bean>

<bean name="/registration.htm" class="springapp.web.RegController">
      <property name="sessionForm" value="true"/>
      <property name="commandName" value="register"/>
      <property name="commandClass" value="springapp.domain.User"/>
         <property name="validator">
            <ref bean="RegistrationValidatorBean"/>
        </property>
      <property name="formView" value="registrationForm"/>
      <property name="successView" value="registrationSuccess"/>
</bean>

and its working great

Thanks again,
Vishwa

[Hong Anderson]

Congrats, using dependency injection is the very reason to use Spring Framework .

From now on, you should realize the full power of Spring . DI is really a great concept, dependencies to implementations could be almost eliminated from source codes.