I have a Spring Boot controller where I'm using @RequestHeader to enforce required headers. However, even with @NotBlank, the controller still accepts requests where the required header is an empty string (""), which I need to prevent.

Here's a simplified version of my controller:

public interface Controller{

@RequestMapping(
    method = RequestMethod.POST,
    value = "/some-endpoint",
    produces = {"application/json"},
    consumes = {"application/json"}
)
public ResponseEntity<?> processRequest(
    @NotBlank @RequestHeader(value = "request-id", required = true) String requestId,

    @RequestHeader(value = "optional-header", required = false) String optionalHeader,

    @NotBlank @RequestHeader(value = "mandatory-header", required = true) String mandatoryHeader,

    @Valid @RequestBody SomeRequestObject requestBody
);

What I've tried:

• Using @NotBlank on @RequestHeader → Still allows empty string ("").
• Adding spring-boot-starter-validation Gradle dependency → No change.
• Applying @Validated at the class level → Works for @RequestBody but not for @RequestHeader.

How can I ensure that request-id and mandatory-header must not be empty ("") at the header level without manually checking them inside the method?

I have a Spring Boot controller where I'm using @RequestHeader to enforce required headers. However, even with @NotBlank, the controller still accepts requests where the required header is an empty string (""), which I need to prevent.

Here's a simplified version of my controller:

public interface Controller{

@RequestMapping(
    method = RequestMethod.POST,
    value = "/some-endpoint",
    produces = {"application/json"},
    consumes = {"application/json"}
)
public ResponseEntity<?> processRequest(
    @NotBlank @RequestHeader(value = "request-id", required = true) String requestId,

    @RequestHeader(value = "optional-header", required = false) String optionalHeader,

    @NotBlank @RequestHeader(value = "mandatory-header", required = true) String mandatoryHeader,

    @Valid @RequestBody SomeRequestObject requestBody
);

What I've tried:

• Using @NotBlank on @RequestHeader → Still allows empty string ("").
• Adding spring-boot-starter-validation Gradle dependency → No change.
• Applying @Validated at the class level → Works for @RequestBody but not for @RequestHeader.

How can I ensure that request-id and mandatory-header must not be empty ("") at the header level without manually checking them inside the method?

• java
• spring
• spring-boot

• Possible duplicate of: stackoverflow/questions/68955985/… – Siddharth Commented Mar 13 at 10:04
• 2 Why is this an interface? Annotations aren't inherited hence marking this as @Validated won't work as the annotations are lost. The @Valid on the request body works regardless of the @Validated at the class level or not. – M. Deinum Commented Mar 13 at 12:17
• @M.Deinum It is an interface because we want to support versioning by using a ControllerImpl to implement different versions of this endpoint where applicable. – kingified Commented Mar 18 at 22:20
• Multiple implementations won't work as you cannot have multiple endpoints for the same URL. – M. Deinum Commented Mar 19 at 7:22

2 Answers 2

There are multiple ways to fix this.

1. Create a custom validator annotation & use this in your method.

2. Use a Global interceptor where you can check for empty header values.

3. The simplest one is to manually check the header for empty string.

if (requestId == null || requestId.trim().isEmpty()) {
            throw new IllegalArgumentException("Header 'request-id' must not be empty or blank.");
        }
        if (mandatoryHeader == null || mandatoryHeader.trim().isEmpty()) {
            throw new IllegalArgumentException("Header 'mandatory-header' must not be empty or blank.");
        }

//create custom validator interface and try to implement it
@RestController
@RequestMapping("/some-endpoint")
@Validated  // Important! Required for custom validation to work
public class MyController {

    @PostMapping
    public ResponseEntity<?> processRequest(
            @ValidHeader @RequestHeader(value = "request-id", required = true) String requestId,
            @RequestHeader(value = "optional-header", required = false) String optionalHeader,
            @ValidHeader @RequestHeader(value = "mandatory-header", required = true) String mandatoryHeader,
            @Valid @RequestBody SomeRequestObject requestBody) {
        
        return ResponseEntity.ok("Request processed successfully");
    }
}