REST API in Spring Boot Application not throwing Bad request though I am passing incorrect properties of the input POJO - spring

Question

This is my REST API:
#RequestMapping(value="/test1")
public String test1(#RequestBody TestPOJO tpj) {
if(tpj instanceof TestPOJO) {
System.out.println("Correct data format passed ");
}
return "working1";
}
This is structure of TestPOJO:
public class TestPOJO {
private String x;
private String y;
public String getX() {
return x;
}
public void setX(String x) {
this.x = x;
}
public String getY() {
return y;
}
public void setY(String y) {
this.y = y;
}
}
In POSTMAN client I am passing this requestbody to this API:
{
"sd":"u",
"egergdrg":34
}
Its printing "Correct data format passed ".Why this input structure is taken as a instance of "TestPOJO". I am passing completely different property inside the body even with different type of data. Isn't it supposed to give 400 Bad Request error ? Why its running successfully? How can I validate all the incoming request body is having proper structure similar to input parameter and if not return 400 error?
FYI Dependency added in pom.xml are "spring-boot-starter-web", "spring-boot-starter-test", "spring-boot-devtools".

Answer 1

You can validate your request body. Just annotate your reqúest body like this #Valid #RequestBody TestPOJO tpj then in your POJO Class, add e.g. following annotations to the fields:
#Size(min=5, max=5)
private String x;
which would actually check the length of the String x.
You can use more annotations, relying in the javax.annotation package.
Keep in minde that you need an annotation processor to make it work, e.g. hibernate-validator-annotation-processor

Answer 2

You can refer to this tutorial - Validating Form Input on Spring official website.
I modified your source as follows and tested it with Postman, now it will return 400 (Bad Request). And I don't think it should return 401 for wrong input data.
Your TestPOJO:
public class TestPOJO {
#NotNull
private String x;
#NotNull
private String y;
public String getX() {
return x;
}
public void setX(String x) {
this.x = x;
}
public String getY() {
return y;
}
public void setY(String y) {
this.y = y;
}
}
Your REST API:
#RequestMapping(value="/test1")
public String test1(#Valid #RequestBody TestPOJO tpj) {
if(tpj instanceof TestPOJO) {
System.out.println("Correct data format passed ");
}
return "working1";
}
BTW, once you add the dependency of spring-boot-starter-web into your pom file, the hibernate-validator will be added automatically.

Answer 3

this is because of the updates on the latest springboot version regarding the object mapper FailOnUnknownProperties. if you add this bean to your configuration, you will get 400 as expected
#Bean
public Jackson2ObjectMapperBuilder mapperBuilder() {
return new Jackson2ObjectMapperBuilder().failOnUnknownProperties(true);
}