Spring REST如何为类中所有API配置必填@RequestParam（如token）

Alright, let's tackle these two Spring REST questions one by one—they're both common scenarios when enforcing API standards, so great asks!

1. How to enforce @RequestParam for all Spring REST APIs #

If you want to make sure every REST endpoint in your application requires at least one @RequestParam parameter (or ensures incoming request parameters are bound via @RequestParam), you have two reliable options using Spring's AOP or HandlerInterceptor capabilities.

Option 1: Use AOP to validate method signatures

Create an aspect that checks every controller method (annotated with @RequestMapping or its shortcuts like @GetMapping) to ensure it has at least one parameter marked with @RequestParam. If not, throw an exception to block the request.

Here's a working example:

import org.aspectj.lang.JoinPoint;
import org.aspectj.lang.annotation.Before;
import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.reflect.MethodSignature;
import org.springframework.stereotype.Component;
import org.springframework.web.bind.annotation.RequestParam;
import java.lang.reflect.Method;
import java.lang.reflect.Parameter;
import java.util.Arrays;

@Aspect
@Component
public class RequestParamEnforcerAspect {

    // Target all controller methods with @RequestMapping and its variants
    @Before("execution(* com.yourpackage.controller..*(..)) && " +
            "(@annotation(org.springframework.web.bind.annotation.RequestMapping) || " +
            "@annotation(org.springframework.web.bind.annotation.GetMapping) || " +
            "@annotation(org.springframework.web.bind.annotation.PostMapping))")
    public void enforceRequestParamPresence(JoinPoint joinPoint) {
        MethodSignature signature = (MethodSignature) joinPoint.getSignature();
        Method method = signature.getMethod();
        Parameter[] parameters = method.getParameters();

        // Check if any parameter has @RequestParam
        boolean hasRequestParam = Arrays.stream(parameters)
                .anyMatch(param -> param.isAnnotationPresent(RequestParam.class));

        if (!hasRequestParam) {
            throw new IllegalArgumentException(
                String.format("Endpoint %s requires at least one @RequestParam parameter",
                method.getName())
            );
        }
    }
}

This aspect runs before every controller method and throws an error if no @RequestParam is declared. Adjust the pointcut to target specific packages or controllers if you don't want global enforcement.

Option 2: Use a HandlerInterceptor

If you prefer avoiding AOP, a HandlerInterceptor can check incoming requests to ensure they include query parameters (this validates the actual request, not just the method signature):

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.stereotype.Component;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.HandlerInterceptor;

@Component
public class RequestParamValidationInterceptor implements HandlerInterceptor {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        if (handler instanceof HandlerMethod) {
            // Reject requests with no query parameters
            if (request.getParameterMap().isEmpty()) {
                response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Request must include query parameters");
                return false;
            }
        }
        return true;
    }
}

Don't forget to register the interceptor in your WebMvcConfigurer:

import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class WebConfig implements WebMvcConfigurer {

    private final RequestParamValidationInterceptor validationInterceptor;

    public WebConfig(RequestParamValidationInterceptor validationInterceptor) {
        this.validationInterceptor = validationInterceptor;
    }

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(validationInterceptor);
    }
}

2. Can we configure a class-level required @RequestParam (like token) for all APIs in a controller? #

Absolutely! This is a common requirement for authentication tokens, and Spring gives you a clean way to do this using @ModelAttribute.

Using @ModelAttribute for class-level required parameters

Define a @ModelAttribute method in your controller class—this method executes before every request handler method in the controller. Declare your required token parameter here, and Spring will automatically enforce it's present in the request.

Example:

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.ModelAttribute;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/user")
public class UserController {

    // Runs before every method in this controller
    @ModelAttribute
    public void validateAndBindToken(@RequestParam("token") String token) {
        // Add token validation logic here (e.g., check against auth service)
        if (token == null || token.isBlank()) {
            throw new IllegalArgumentException("Token is required and cannot be empty");
        }
        // Optional: Store token in request attributes for use in handler methods
        // request.setAttribute("authToken", token);
    }

    @GetMapping("/profile")
    public String getUserProfile() {
        // No need to declare @RequestParam("token") here—it's already enforced
        return "User profile data";
    }

    @PostMapping("/update")
    public String updateUser(@RequestParam("name") String newName) {
        // Same here: token is automatically required
        return "Updated user name to: " + newName;
    }
}

With this setup, any request to /user/profile or /user/update will fail with a 400 Bad Request if the token query parameter is missing. Spring handles parameter binding and validation automatically.

Alternative: HandlerInterceptor for targeted controllers

If you want to apply this to multiple controllers without repeating code, use a HandlerInterceptor that checks for the token only for specific controller classes:

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.stereotype.Component;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.HandlerInterceptor;

@Component
public class TokenRequiredInterceptor implements HandlerInterceptor {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        if (handler instanceof HandlerMethod) {
            HandlerMethod handlerMethod = (HandlerMethod) handler;
            Class<?> controllerClass = handlerMethod.getBeanType();

            // Apply check only to specified controllers
            if (UserController.class.isAssignableFrom(controllerClass) || 
                AdminController.class.isAssignableFrom(controllerClass)) {
                
                String token = request.getParameter("token");
                if (token == null || token.isBlank()) {
                    response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Token is required");
                    return false;
                }
            }
        }
        return true;
    }
}

Register this interceptor in your WebConfig like the earlier example, and it will enforce the token requirement for all methods in your target controllers.

内容的提问来源于stack exchange，提问作者unnik