title: In which layer should validation be performed?
body: <p>I am writing a webservice. </p>
  
  <p>Typically the input will be an XML document and the output XML or JSON. </p>
  
  <p>The application uses the MVC patter, having different layers</p>
  
  <ul>
  <li>Controllers: Receive XML and provide response (XML/JSON)</li>
  <li>Service: Business logic, transactions</li>
  <li>DAO: Query the datasource (a Database or maybe another webservice)</li>
  </ul>
  
  <p>My understanding is that basic validation (ie: XML against XSD) should be done as soon as possible on the Controller layer. </p>
  
  <p>After that, I still need to perform extra validation, some of such validations are basic, for example</p>
  
  <ul>
  <li>Date format must be correct</li>
  <li>User name cannot exceed X characters (maybe also to be performed on the XSD?)</li>
  </ul>
  
  <p>As far as I understand, such basic validations should been done when unmarshalling the XML into a Java object. That would also happend in the controller layer (although the validation itself would be done by the Java object where the XML is unmarshalled into)</p>
  
  <p>And finally I face the more <em>"complex"</em> validations examples</p>
  
  <ul>
  <li>The date should not be prior to 1950 (just a random example)</li>
  <li>If value A is bigger than B, then value C should not exceed D</li>
  </ul>
  
  <p>Such "complex" valiations seems to be a perfect candidate for the javax.validation.Validator interface. And also feels like they should be done in the Controller layer.</p>
  
  <p>The questions are </p>
  
  <ol>
  <li>Is this approach correct? Should I also validate something at other layers?</li>
  <li>Am I adding too much logic into controllers? Should I maybe move some validation to the Service layer where the business logic is?</li>
  </ol>