java 48 lines · 7 steps

Building a custom @StrongPassword validator in Spring

A custom Bean Validation annotation pairs with a validator class to enforce password complexity rules declaratively.

Explained by highlit

Spring Intermediate bean-validation annotations regex custom-constraint

1@Target({ElementType.FIELD, ElementType.PARAMETER})
2@Retention(RetentionPolicy.RUNTIME)
3@Constraint(validatedBy = StrongPasswordValidator.class)
4@Documented
5public @interface StrongPassword {
6 
7    String message() default "Password must be at least 8 characters and include upper, lower, digit, and special characters";
8 
9    int minLength() default 8;
10 
11    Class<?>[] groups() default {};
12 
13    Class<? extends Payload>[] payload() default {};
14}
15 
16public class StrongPasswordValidator implements ConstraintValidator<StrongPassword, String> {
17 
18    private static final Pattern UPPER = Pattern.compile("[A-Z]");
19    private static final Pattern LOWER = Pattern.compile("[a-z]");
20    private static final Pattern DIGIT = Pattern.compile("\\d");
21    private static final Pattern SPECIAL = Pattern.compile("[^A-Za-z0-9]");
22 
23    private int minLength;
24 
25    @Override
26    public void initialize(StrongPassword annotation) {
27        this.minLength = annotation.minLength();
28    }
29 
30    @Override
31    public boolean isValid(String value, ConstraintValidatorContext context) {
32        if (value == null) {
33            return true;
34        }
35        boolean valid = value.length() >= minLength
36                && UPPER.matcher(value).find()
37                && LOWER.matcher(value).find()
38                && DIGIT.matcher(value).find()
39                && SPECIAL.matcher(value).find();
40 
41        if (!valid && StringUtils.hasText(value)) {
42            context.disableDefaultConstraintViolation();
43            context.buildConstraintViolationWithTemplate(context.getDefaultConstraintMessageTemplate())
44                    .addConstraintViolation();
45        }
46        return valid;
47    }
48}

01 / 01

STEP 01

Walkthrough

Space play ←→ step click any line

Three takeaways

1A custom constraint is two parts: the annotation declaring metadata and the validator holding the logic.
2Wiring a validator to an annotation via @Constraint(validatedBy=...) lets you validate fields declaratively anywhere.
3Returning true for null delegates presence checks to @NotNull, keeping each constraint focused on one concern.

Related explainers

java

public interface GitHubClient {
 
    @GetExchange("/users/{username}")
    GitHubUser getUser(@PathVariable String username);

Declarative HTTP clients in Spring

http-client declarative-api proxy

Intermediate 8 steps

ruby

class TemplateInterpolator
  PLACEHOLDER = /\{\{\s*([\w.]+)\s*\}\}/
 
  def initialize(strict: false)

Interpolating templates with dotted keys in Ruby

regex string-interpolation hash-traversal

Intermediate 6 steps

java

import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

Building a trie for autocomplete in Java

trie prefix-tree recursion

Intermediate 8 steps

java

@RestController
@RequestMapping("/api/products")
public class ProductSearchController {

Binding collection query params in Spring

rest-api query-parameters dependency-injection

Intermediate 6 steps

java

import java.util.ArrayDeque;
import java.util.Deque;
import java.util.Map;

Evaluating math expressions with two stacks

stacks parsing operator-precedence

Intermediate 9 steps

java

@Entity
@Table(name = "orders")
@SQLDelete(sql = "UPDATE orders SET deleted = true, deleted_at = now() WHERE id = ?")
@Where(clause = "deleted = false")