REST API是否需验证全部路径参数？以指定路由为例探讨

Great question—this is a common point of debate when building REST APIs, and there are several practical, real-world reasons you’d want to validate both path parameters, even if you could fetch the product by its ID alone. Let’s break them down:

• Prevent unauthorized data access
  Even if you think product_id is globally unique, it’s not uncommon for systems to use auto-incrementing IDs per merchant (e.g., each merchant starts their product IDs at 1). If you only validate product_id, a malicious user could guess or reuse a product ID from another merchant to access data they shouldn’t have. Validating both parameters ensures the product actually belongs to the specified merchant, locking down resource access to the correct owner.

• Improve caching and query performance
  Caching layers (like Redis) work best with granular keys. Using {merchant_id}:{product_id} as your cache key avoids collisions where two merchants have products with the same ID. On the database side, a composite index on (merchant_id, product_id) will speed up queries significantly—filtering by merchant first narrows down the result set before looking for the product ID, which is far more efficient than querying a global product ID in a large table.

• Align with REST resource semantics
  The endpoint /merchant/{merchant_id}/product/{product_id} explicitly represents a product belonging to a specific merchant, not just a standalone product. Validating both parameters reinforces this semantic meaning. It makes your API’s intent clearer to developers using it, and ensures clients are interacting with the hierarchical resource they intended, rather than a generic product entity.

• Provide more accurate error feedback
  If you only check product_id, a request for a product that exists but doesn’t belong to the specified merchant will return a 404 "Not Found"—which is misleading. By validating both, you can return a 403 "Forbidden" or a custom error message like "Product 123 does not belong to merchant 456", helping clients debug issues faster instead of wasting time looking for a non-existent product.

• Support future business needs
  As your system grows, you might add features like merchant-specific product analytics, role-based access control (e.g., sub-users who can only manage their merchant’s products), or bulk operations for a merchant’s catalog. Validating both parameters from the start means you won’t have to refactor your core API logic later to accommodate these use cases.

Of course, if your product_id is guaranteed to be globally unique and the merchant-product relationship is immutable, you might get away with only validating the product ID. But in most real-world scenarios, the benefits of validating both parameters far outweigh the minimal extra effort.

内容的提问来源于stack exchange，提问作者Victor Timoftii