Скачать или смотреть This @Valid Bug Lets Bad Requests Pass Silently

Most Spring Boot devs think @Valid automatically validates everything inside the request body. It doesn’t.
There’s a silent validation trap where nested DTOs and List of DTO elements are NOT validated unless you explicitly enable cascade validation.

In this Production Ready Code (PRC) demo, you’ll see a real bug that returns 200 OK for invalid payloads — and the 1-line fix that makes validation actually enforce rules in production.

✅ What you’ll learn:

Why @Valid can be ignored silently with nested objects

The common bug: @Valid missing on List of DTO / nested DTO fields

The correct fix: @Valid on nested fields + list elements (Bean Validation cascade)

How to prove it with a failing request + proper 400 error response

🧩 PRC takeaway: stop trusting validation “by default”. Make it explicit and test it.

If you build Spring Boot APIs in microservices, fintech, ecommerce, or any production backend — this is one of those bugs that leaks garbage data into your system.

👍 Like / Subscribe for more Production Ready Spring Boot + Java backend pitfalls.

#SpringBoot #Java #Validation #BeanValidation #JakartaValidation #Backend