在 JSR-303 Bean 验证中获取 HttpServletRequest

Question

我在我的应用程序中有一个验证，它使用 cookie (request.getCookies) 来验证验证码。

我想为此验证码验证创建一个 ConstraintValidator，因此它与其他 bean 的属性一起进行验证 - 如 JSR-303 Bean Validation 所指定。

有没有办法在 ConstraintValidator 中检索 HttpServletRequest？

Answer 1

假设（由于存在标签）您使用的是 Spring，使用最新版本的 Spring (>=2.5.1)，这应该很简单

package org.yourapp.controller.validation;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.context.support.SpringBeanAutowiringSupport;

import javax.servlet.http.HttpServletRequest;
import javax.validation.ConstraintValidator;
import javax.validation.ConstraintValidatorContext;

public class YourValidator implements ConstraintValidator<YourValidatorAnnotaion, String> {
    // here should be autowired a proxy to currently undergoing request
    @Autowired
    private HttpServletRequest request;

    @Override
    public void initialize(YourValidatorAnnotaion constraintAnnotation) {
        // this should autowire all dependencies of this class using
        // current application context
        SpringBeanAutowiringSupport.processInjectionBasedOnCurrentContext(this);
    }

    @Override
    public boolean isValid(String value, ConstraintValidatorContext context) {
        // here goes your custom logic for validation, like matching
        // captcha challenge to captcha response, but i am not doing
        // this for you, as i don't know what it supposed to be, so
        // i simply test presence of cookies.
        return request.getCookies().length > 0;
    }
}

为了完整起见，这里是一个示例@YourValidatorAnnotaion实现：

package org.yourapp.controller.validation;

import javax.validation.Constraint;
import javax.validation.Payload;
import java.lang.annotation.Retention;
import java.lang.annotation.Target;

import static java.lang.annotation.ElementType.*;
import static java.lang.annotation.RetentionPolicy.RUNTIME;

@Constraint(validatedBy = YourValidator.class)
@Target({ METHOD, FIELD, ANNOTATION_TYPE, CONSTRUCTOR, PARAMETER })
@Retention(RUNTIME)
public @interface YourValidatorAnnotaion {
    String message() default "No cookies - no validation";
    Class<?>[] groups() default {};
    Class<? extends Payload>[] payload() default {};
}

就是这样。现在，如果您使用 注释您的 DTO 字段@YourValidatorAnnotaion，则每当@Valid @RequestBody在请求标头中没有 cookie 的情况下调用具有此类参数的控制器时，您都会收到错误消息。