Validation and exception handling

Bean Validation (the jakarta.validation API, implemented by Hibernate Validator) checks constraints declared as annotations. Spring Boot's web starter does not include it; add spring-boot-starter-validation.

public record NewCustomer(
        @NotBlank String name,
        @NotNull @Email String email,
        @Size(min = 8, max = 64) String password,
        @Valid @NotNull Address address) {}   // @Valid cascades into the nested object

@PostMapping("/customers")
CustomerDto create(@RequestBody @Valid NewCustomer body) { ... }

When the body violates any constraint, the controller method never runs: Spring throws MethodArgumentNotValidException, which becomes a 400 Bad Request. The validator does not stop at the first problem — it reports every violated constraint, so the client can fix all of them in one round trip. Each violation carries a property path — name, address.city, or lines[2].sku for an element of a list — and the constraints of a nested object are only checked when the field holding it is marked @Valid.

null is (mostly) valid

Almost every constraint treats null as valid. @Size(min = 8) and @Email say nothing about a missing value; that is the job of the three "not" constraints, which differ precisely in what they reject:

1import java.util.*;2 3public class Solution {4    static boolean notNull(String v)  { return v != null; }5    static boolean notEmpty(String v) { return v != null && !v.isEmpty(); }6    static boolean notBlank(String v) { return v != null && !v.isBlank(); }7    static boolean size3to10(String v) { return v == null || (v.length() >= 3 && v.length() <= 10); } // null is valid8 9    public static List<String> run() {10        List<String> rows = new ArrayList<>();11        String[] inputs = {null, "", "   ", "ab"};12        for (String v : inputs) {13            String shown = v == null ? "null" : "\"" + v + "\"";14            rows.add(shown + " NotNull=" + notNull(v) + " NotEmpty=" + notEmpty(v)15                + " NotBlank=" + notBlank(v) + " Size(3,10)=" + size3to10(v));16        }17        return rows;18    }19}

@NotNull rejects only null. @NotEmpty also rejects a zero-length string (or empty collection). @NotBlank, for strings only, also rejects whitespace. A required text field is almost always @NotBlank; a required number or object is @NotNull.

Turning exceptions into responses

An exception that escapes a controller method is offered to @ExceptionHandler methods. They can live in the controller itself (handling only that controller's exceptions) or in a @RestControllerAdvice class that applies across controllers.

@RestControllerAdvice
class ApiErrors {
    @ExceptionHandler(OrderNotFoundException.class)
    ProblemDetail notFound(OrderNotFoundException e) {
        return ProblemDetail.forStatusAndDetail(HttpStatus.NOT_FOUND, e.getMessage());
    }
}

The resolution rules interviewers probe:

1. Handlers declared in the controller that threw are tried first. If one of them matches, it is used — even if an advice has a more specific handler.
2. Otherwise the advice classes are tried (in @Order order).
3. Within one class, the handler for the closest type in the exception's hierarchy wins: for OrderNotFoundException extends NotFoundException extends RuntimeException, a handler for NotFoundException beats one for RuntimeException.

1import com.fasterxml.jackson.databind.ObjectMapper;2import java.util.*;3 4public class Solution {5    record FieldError(String field, String message) {}6 7    static List<FieldError> validate(Map<String, String> body) {8        List<FieldError> errors = new ArrayList<>();9        String name = body.get("name"), email = body.get("email"), password = body.get("password");10        if (name == null || name.isBlank()) errors.add(new FieldError("name", "must not be blank"));11        if (email == null) errors.add(new FieldError("email", "must not be null"));12        else if (!email.contains("@")) errors.add(new FieldError("email", "must be a well-formed email address"));13        if (password != null && (password.length() < 8 || password.length() > 64))14            errors.add(new FieldError("password", "size must be between 8 and 64"));15        return errors;16    }17 18    public static String run() throws Exception {19        Map<String, String> body = new HashMap<>();20        body.put("name", " ");21        body.put("email", "not-an-email");22        body.put("password", "short");23 24        List<FieldError> errors = validate(body);25        Map<String, Object> problem = new LinkedHashMap<>();26        problem.put("type", "about:blank");27        problem.put("title", "Bad Request");28        problem.put("status", 400);29        problem.put("detail", errors.size() + " field(s) are invalid");30        problem.put("errors", errors);   // a record serialises its fields in declaration order31        return new ObjectMapper().writeValueAsString(problem);32    }33}

Common mistakes

• Using @NotNull on a required name and accepting "" or " " — only @NotBlank rejects both, as the first example shows.
• Forgetting @Valid on the @RequestBody parameter (nothing is validated) or on a nested object field (its constraints are skipped).
• A catch-all @ExceptionHandler(Exception.class) that returns 500 for everything, swallowing the 400s and 404s Spring would have produced, and often leaking exception messages to clients.

What interviewers ask

• Difference between @NotNull, @NotEmpty and @NotBlank? — what each rejects: null; null or empty; null, empty or whitespace only.
• A controller has a handler for RuntimeException and a @ControllerAdvice has one for OrderNotFoundException. Which runs? — the controller's own handler; local handlers are tried before any advice.
• How do you return consistent error responses across an API? — one @RestControllerAdvice, ProblemDetail bodies, a stable error , and every field error for validation failures.