where to do input validation

Suppose the business layer is consumed by web and some of the business layer's functionality is open to public also as REST web services.

Would you do input validation for business logic at presentation layer (web or REST web service) or in business layer and capture the validation errors (thrown by business layer) at presenta开发者_StackOverflow中文版tion layer?

(Specifically spring framework is in use)

When in doubt, it is generally better to put business logic (incl input validation logic) in the business layer because

• You may be dealing with multiple presentation mediums (e.g., web GUI and API)
• You don't want to repeat code and manage two instances of that logic

Good frameworks will allow you to define such logic in a common place and support catching issues early (e.g., in the presentation layer), which is usually a more intuitive (fail fast), more scalable (front end catches it) solution.

However, if your framework(s) do not support this capability, you should prefer consistency and maintainability and put the logic in the business layer.

I reccomend implementing validation in all layters. I do the UI so the user experience is high, with immediate feedback. But I never trust the data provided by the UI (think a user who disables JS). Now how detailed your server-side validation goes is up to you. But you want to avoid having your user have to suffer through a full round trip to the server if you can.

Violations of business rules should always happen in the business layer. Whether you allow for proactive checking or not is a design decision, as is whether you want to do eager checking on the client to avoid round-trips.