Loading published curriculum…

12 · Spring Boot and the web request lifecycle / LESSON 56 OF 102

DTOs, JSON serialization, and validation boundaries

A transport DTO exposes only the fields a caller may send or receive.

Before this lesson: Resource design, HTTP methods, and status codes

Understand the topic

Returning JPA entities can leak internal fields, trigger lazy queries, or recurse through relationships. Define request and response records and map explicitly. Do not accept ownerId, roles, or server-managed timestamps merely because those fields exist on the entity.

Use @Valid on a request body to activate nested validation. Choose constraints that reflect the contract: @NotNull permits an empty string, while @NotBlank rejects blank text. Validate domain invariants again where non-HTTP callers can reach the service.

EXAMPLE · JAVA

CreateTaskRequest.java

import jakarta.validation.constraints.*;
public record CreateTaskRequest(
 @NotBlank @Size(max = 160) String title
) {}

What to expect

Use as an @Valid @RequestBody parameter with the validation starter. The authenticated principal supplies ownership separately.

YOUR TURN

Put it into practice

  1. 01Introduce separate create-request and task-response DTOs.
  2. 02Send unexpected ownership fields and verify they cannot change the authenticated owner.
  3. 03Verify: No password hash, internal relationship graph, or writable role field appears in the API contract.

Pass a quiz or complete a lab to check today’s streak. Each lesson counts once per day, including when you review it later.

UNDER THE HOOD

Build the mental model

A transport DTO exposes only the fields a caller may send or receive.

  1. 01Returning JPA entities can leak internal fields, trigger lazy queries, or recurse through relationships. Define request and response records and map explicitly. Do not accept ownerId, roles, or server-managed timestamps merely because those fields exist on the entity.
  2. 02Use @Valid on a request body to activate nested validation. Choose constraints that reflect the contract: @NotNull permits an empty string, while @NotBlank rejects blank text. Validate domain invariants again where non-HTTP callers can reach the service.
  3. 03Trace the example: Use as an @Valid @RequestBody parameter with the validation starter. The authenticated principal supplies ownership separately.

A mistake worth avoiding

Serializing a task causes recursion through its owner and task collection.

DEBUGGING ROOM

Something broke. Where do you look?

Serializing a task causes recursion through its owner and task collection.

Before revealing the diagnosis, write down your first investigation step.

CHECK YOUR UNDERSTANDING

Should a create-task request choose its owner from an arbitrary ownerId field?

Choose one answer

BUILD IT YOURSELF

Introduce separate create-request and task-response DTOs.

  1. 1.Introduce separate create-request and task-response DTOs.
  2. 2.Send unexpected ownership fields and verify they cannot change the authenticated owner.
  3. 3.Reproduce this failure, then repair it: Serializing a task causes recursion through its owner and task collection.

Acceptance checklist

Lab completion is your self-report. Knowledge checks do not certify project quality.

RETRIEVE IT FROM MEMORY

Should a create-task request choose its owner from an arbitrary ownerId field?

Revisit this lesson in three days after a successful check or lab.

Ready for the next step?

No password hash, internal relationship graph, or writable role field appears in the API contract.

Reading is separate from passing a knowledge check or completing a lab.

Go deeper · official references