在JSR-303 Bean验证中获取HttpServletRequest

Question

我的应用程序中有一个验证，它使用cookies（request.getCookies）来验证验证码。

我想为这个captcha验证创建一个ConstraintValidator，以便它与其他bean的属性一起进行验证——正如JSR-303 bean验证所指定的那样。

有没有办法在ConstraintValidator中检索HttpServletRequest？

Answer 1

假设（由于当前标记）您使用的是Spring，其中包含一个最新版本的(

package org.yourapp.controller.validation;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.context.support.SpringBeanAutowiringSupport;

import javax.servlet.http.HttpServletRequest;
import javax.validation.ConstraintValidator;
import javax.validation.ConstraintValidatorContext;

public class YourValidator implements ConstraintValidator<YourValidatorAnnotaion, String> {
    // here should be autowired a proxy to currently undergoing request
    @Autowired
    private HttpServletRequest request;

    @Override
    public void initialize(YourValidatorAnnotaion constraintAnnotation) {
        // this should autowire all dependencies of this class using
        // current application context
        SpringBeanAutowiringSupport.processInjectionBasedOnCurrentContext(this);
    }

    @Override
    public boolean isValid(String value, ConstraintValidatorContext context) {
        // here goes your custom logic for validation, like matching
        // captcha challenge to captcha response, but i am not doing
        // this for you, as i don't know what it supposed to be, so
        // i simply test presence of cookies.
        return request.getCookies().length > 0;
    }
}

为了确保完整性，下面是一个示例YourValidatorAnnotation实现：

package org.yourapp.controller.validation;

import javax.validation.Constraint;
import javax.validation.Payload;
import java.lang.annotation.Retention;
import java.lang.annotation.Target;

import static java.lang.annotation.ElementType.*;
import static java.lang.annotation.RetentionPolicy.RUNTIME;

@Constraint(validatedBy = YourValidator.class)
@Target({ METHOD, FIELD, ANNOTATION_TYPE, CONSTRUCTOR, PARAMETER })
@Retention(RUNTIME)
public @interface YourValidatorAnnotaion {
    String message() default "No cookies - no validation";
    Class<?>[] groups() default {};
    Class<? extends Payload>[] payload() default {};
}

就是这样。现在，如果您使用YourValidatorAnnotation对DTO字段进行注释，那么当在请求头中没有cookie的情况下调用具有此类有效@RequestBody参数的控制器时，您应该会得到一个错误。