Why is @Valid on request bodies plus parameterized queries part of secure coding in Spring?
Options
- Validation blocks bad input; bound params stop SQLi (Correct option)
- They only improve the speed of each request made
- They encrypt all the traffic that the API handles
- They hide stack traces from users and bots alike
Answer
Validation rejects malformed input early, and bound parameters prevent SQL injection; neither alone is enough
Why
Most web vulnerabilities start with untrusted input. Secure coding checklist:
- Validate input (type, length, format, allow-list) on the server.
- Use parameterized queries / JPA parameters, never string concatenation.
- Encode output for the context (HTML, JS) to stop XSS.
- Check authorization on every request, not only login.
- Do not leak stack traces or internal errors to clients.
- Keep dependencies and frameworks patched.
Remember
Validate input, parameterize queries, encode output, authorize every call.