我应该在 MVC 层和服务层中重复验证吗？
我现在的心情有点矛盾。我有一个 Web 应用程序，使用 Stripes 作为 MVC 框架，使用 Spring/Hibernate 作为后端。我的 MVC 层中有一个帐户注册方法，需要以下验证：
- 用户名尚未使用
- 提供的电子邮件地址尚未与另一个帐户关联
我在 Stripes（MVC 层）中有一个验证方法，用于检查这两种情况，但想知道我的服务层是否应该重复这些检查？如果服务层接口作为 Web 服务公开，那么我认为验证将是一个好主意，但如果它仅在 Web 应用程序的上下文中使用，是否需要它？
编辑：我不打算复制验证代码 - 我的意思是在两个地方复制验证方法调用。
我将我的选项视为：
- 在 MVC 和服务层中复制验证调用
- 仅在 MVC 层中执行此验证
- 仅在服务层中执行此验证。
这里的最佳实践是什么？我正在寻找关于我应该选择哪个选项以及为什么的建议/意见。
请注意，对注册表单的输入字段进行了简单的验证检查（例如检查空白），并且我认为这些应该仅由 MVC 验证来处理；我只关心更复杂的验证。
I'm feeling a little conflicted at the moment. I have a web application using Stripes for an MVC framework and Spring/Hibernate for the back-end. I have an account registration method in my MVC layer which requires the following validation:
- Username is not already taken
- The provided email address is not already associated with another account
I have a validation method in Stripes (MVC layer) that checks these two cases but was wondering whether my service layer should duplicate these checks? If the service layer interface was exposed as a web service then I think the validation would be a good idea, but if it's only used in the context of a web application is it required?
Edit: I'm not intending to duplicate the validation code - I mean duplicating the validation method calls in two places.
I see my options as:
- Duplicate the validation calls in both MVC and service layer
- Only perform this validation in the MVC layer
- Only perform this validation in the service layer.
What's best practice here? I'm looking for advice/opinions on which option I should go with and why.
Note that there are simple validation checks on the input fields of the registration form (like checking for blanks) and that I think these should be handled by the MVC validation only; I'm only concerned about more complex validations.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
不要重复代码。使用 JSR303 Bean 验证，以便您可以在所有层中使用相同的验证逻辑你的应用程序。
Hibernate Validator（一个独立于 Hibernate ORM 的项目）提供了这个的参考实现界面。使用起来非常简单，您可以 快速开始使用。
Don't duplicate code. Use JSR303 Bean Validation so you can use the same validation logic in all layers of your app.
Hibernate Validator (a separate project from the Hibernate ORM stuff) provides the reference implementation of this interface. It is dead simple to use, you can get started with it very quickly.
在我看来，您应该区分两种验证：
在您的情况下，您的验证与业务规则相关，因此我将仅将它们放在服务层中。
此外，如果您在两个层中重复验证，您将进行两次相同的查询，从而降低应用程序的性能。
In my opinion you should diferenciate two kinds of validations:
In your case your validations are related to business rules, so I will put them only in the service layer.
In addition, if you duplicate your validations in both layers you will be making the same queries twice, slowing down the performance of your application.
安妮，
好问题，我曾多次问过自己同样的问题。这就是我最终得到的结果（到目前为止）。
最纯粹（但乏味）的方法是调用两层中的验证逻辑。
务实的方法可能是仅在网络领域（例如您的控制器）中调用它。
我认为没有一个答案可以结束所有的讨论。我认为这取决于您的项目的背景。如果项目规模不大（就人员和代码库大小而言），并且您确信其他人不会开发大量调用您的服务 API 的代码（在某种程度上您将无法监督），那么仅在 Web 层进行验证就足够了。
但是，如果您预计有很多客户，您可能需要更高级别的安全性。当我在这里说安全性时，我将其称为您需要的一致性保证级别。
如果该级别很高，则没有办法解决它：您将必须在服务（出于安全性）和 Web 层（主要是为了能够为最终用户提供可接受的体验）中执行此操作。
因此，这里的关键驱动因素是安全性以及您真正需要多少安全性。如果您需要很多，您就会选择“纯粹”方法。如果您的应用程序没有做出涉及生死问题的决策，那么您会选择务实的方法。
Annie,
Good question, I have asked myself the same in many occasions. Here's what I ended up with (until now).
The purest (but tedious) approach is to invoke the validation logic in both layers.
the pragmatic approach could be to only invoke it in web-land (e.g. your controllers).
I think there is no answer that ends all discussion. I think that it depends on the context of your project. If the project-size is modest (in terms of people and size of codebase) and you are confident that not a whole lot of code will be developed by others that invoke your service API (to an extent that you will not be able to oversee), then doing the validation in the web-layer only may well suffice.
However, if you expect many clients you may need a higher-level security. When I say security here, I refer to it as the level of consistency-guarantees that you need.
If that level is high, there is no way around it: you will have to do it in both the service (for security) and the web layer (mostly to be able to provide end-users with an acceptable experience).
So the key driver here is security and how much of it you really need. If you need a lot, you go for the 'purist' approach. If your application doesn't exactly make decisions that concern matters of life and death, you go for the pragmatic approach.
理想情况下，在两个层中都进行验证，因为您的服务层可能与当前 mvc 层以外的客户端一起使用
在两个地方重用验证机制（例如 Bean 验证）
Ideally, do the validation in both layers, since your service layer may be used with a client other than the current mvc layer
Reuse the validation mechanism at both places (Bean validation, for example)