Agree with Pangea, you should definitely have validations in the client and service endpoints.
I would add that the concept of validations is to be "fail-fast". You add validations to each layer so that the user or caller would get immediate feedback as to why the call would fail instead of potentially starting a transaction, making complex queries and doing a write only to find that a field is too short.
On the client-side, you want as much validation as possible so that you won't waste the user's time, bandwidth and server-side resources (which have contentions in many cases). However, you usually can't do all validations on the client-side (for example, to check for whether there is already such a username in use on signup) so you would want that checked and a proper error message returned as soon as you hit the service layer.
On the server layer, you want to assume that all inputs are potentially dangerous and incorrect (and they often times will be). I actually think it's better to be more comprehensive and aggressive on validating inputs on the service layer since that's your last line of defense. If you leave out a validation or two on the client side, you just need a nice fault handling mechanism to let the users know what's wrong. If you miss something on the service side and disaster strikes, it could mean hours or days of debugging and trying to restore database backups.
There are some checks that are done at the database level as well which enforce things like referential integrity and such. I usually try as much as possible to check for them before attempting a write since interpreting various RDBMS's error messages and trying to convert them back to user understandable lingo is often hard if not impossible.
我不同意您应该在 DAO 中执行验证。 DAO 应该只负责 CRUD 操作。如果他们做得更多，那么你就有了泄漏层。如果您必须批量处理内容，那么您应该确保该批次通过服务层，以便您的批次也经过相同的验证。
If your application provides multiple entry points (UI or system to system interfaces or batch systems) then you should cleanse (null checks, format checks, required-ness etc) your data at all of these edges and before it reaches the service layer. But this doesn't mean you need to replicate your validation logic. You can use frameworks that allow you to centralize your validation. Some example validation frameworks can be found in this post.
However, there are business validations that should belong to your domain layer and they should remain in your domain service layer or domain objects.
I do not agree that you should be performing validation in DAO's. DAO's should just be responsible for CRUD operations. If they are doing more then you have leaky layers. If you have to process stuff in batch then you should make sure the batch comes through service layer so that your batch is also going through the same validations.
The one piece of wisdom I can add to the conversation is, never trust the client. Whether your client be in HTML, Flash/Flex, or whatever, there is a possibility that someone is going to hack it and try to do something that you don't want them to do. The follow up here is, if there is a possibility that someone is going to hack it, we as software engineers must assume that it IS going to get hacked, so while checks on the front end are nice, and can aid in your applications usability, you MUST validate all your inputs on the back end, even if that leads to duplicate checks.
发布评论
评论（3）
同意 Pangea 的观点，您绝对应该在客户端和服务端点中进行验证。
我想补充一点，验证的概念是“快速失败”。您向每一层添加验证，以便用户或调用者能够立即获得有关调用失败原因的反馈，而不是潜在地启动事务、进行复杂的查询并执行写入操作后才发现字段太短。
在客户端，您需要尽可能多的验证，这样就不会浪费用户的时间、带宽和服务器端资源（在许多情况下存在争用）。但是，您通常无法在客户端执行所有验证（例如，检查注册时是否已使用这样的用户名），因此您希望在您执行此操作后立即进行检查并返回正确的错误消息触及服务层。
在服务器层，您希望假设所有输入都有潜在危险和不正确（而且通常会如此）。实际上，我认为最好更全面、更积极地验证服务层上的输入，因为这是您的最后一道防线。如果您在客户端遗漏了一两个验证，那么您只需要一个很好的故障处理机制来让用户知道出了什么问题。如果您错过了服务端的某些内容并且发生了灾难，则可能意味着需要数小时或数天的调试并尝试恢复数据库备份。
还有一些在数据库级别完成的检查，这些检查强制执行诸如引用完整性之类的事情。我通常会在尝试写入之前尽可能多地检查它们，因为解释各种 RDBMS 的错误消息并尝试将它们转换回用户可理解的术语通常很困难（如果不是不可能的话）。
Agree with Pangea, you should definitely have validations in the client and service endpoints.
I would add that the concept of validations is to be "fail-fast". You add validations to each layer so that the user or caller would get immediate feedback as to why the call would fail instead of potentially starting a transaction, making complex queries and doing a write only to find that a field is too short.
On the client-side, you want as much validation as possible so that you won't waste the user's time, bandwidth and server-side resources (which have contentions in many cases). However, you usually can't do all validations on the client-side (for example, to check for whether there is already such a username in use on signup) so you would want that checked and a proper error message returned as soon as you hit the service layer.
On the server layer, you want to assume that all inputs are potentially dangerous and incorrect (and they often times will be). I actually think it's better to be more comprehensive and aggressive on validating inputs on the service layer since that's your last line of defense. If you leave out a validation or two on the client side, you just need a nice fault handling mechanism to let the users know what's wrong. If you miss something on the service side and disaster strikes, it could mean hours or days of debugging and trying to restore database backups.
There are some checks that are done at the database level as well which enforce things like referential integrity and such. I usually try as much as possible to check for them before attempting a write since interpreting various RDBMS's error messages and trying to convert them back to user understandable lingo is often hard if not impossible.
如果您的应用程序提供多个入口点（UI 或系统到系统接口或批处理系统），那么您应该在所有这些边缘和之前清理（空检查、格式检查、必需性等）您的数据它到达服务层。 但这并不意味着您需要复制验证逻辑。您可以使用允许集中验证的框架。可以在此帖子中找到一些示例验证框架。
但是，有些业务验证应该属于您的域层，并且它们应该保留在您的域服务层或域对象中。
我不同意您应该在 DAO 中执行验证。 DAO 应该只负责 CRUD 操作。如果他们做得更多，那么你就有了泄漏层。如果您必须批量处理内容，那么您应该确保该批次通过服务层，以便您的批次也经过相同的验证。
If your application provides multiple entry points (UI or system to system interfaces or batch systems) then you should cleanse (null checks, format checks, required-ness etc) your data at all of these edges and before it reaches the service layer. But this doesn't mean you need to replicate your validation logic. You can use frameworks that allow you to centralize your validation. Some example validation frameworks can be found in this post.
However, there are business validations that should belong to your domain layer and they should remain in your domain service layer or domain objects.
I do not agree that you should be performing validation in DAO's. DAO's should just be responsible for CRUD operations. If they are doing more then you have leaky layers. If you have to process stuff in batch then you should make sure the batch comes through service layer so that your batch is also going through the same validations.
我可以在谈话中添加的一条智慧是，永远不要相信客户。无论您的客户端采用 HTML、Flash/Flex 还是其他格式，都有可能有人会破解它并尝试做一些您不希望他们做的事情。接下来是，如果有人可能会破解它，我们作为软件工程师必须假设它会被黑客入侵，因此虽然前端检查很好，并且可以帮助您的应用程序可用性，您必须在后端验证所有输入，即使这会导致重复检查。
The one piece of wisdom I can add to the conversation is, never trust the client. Whether your client be in HTML, Flash/Flex, or whatever, there is a possibility that someone is going to hack it and try to do something that you don't want them to do. The follow up here is, if there is a possibility that someone is going to hack it, we as software engineers must assume that it IS going to get hacked, so while checks on the front end are nice, and can aid in your applications usability, you MUST validate all your inputs on the back end, even if that leads to duplicate checks.