Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I get the impression that the author doesn't really understand why he's doing what he's doing. The obvious solution in this case is to have addHeader validate its arguments. The reason why you might want to have a separate class that does validation on construction is if you were going to end up validating the string multiple times: then you can just validate once in the constructor, and use the type system to ensure that each header string has been validated at least once.

But is that a realistic concern in this case? The author proposes replacing this:

    response.addHeader("Custom-Language", 
                   request.getParameter("lang"));
With this:

    response.addHeader(new HttpHeaderName("Custom-Language"), 
                   new HttpHeaderValue(request.getParameter("lang")));
This gives absolutely zero benefits over just doing the authentication in addHeader. Every string is still being validated the same number of times, but now the programmer is less productive and the code is more cluttered because of the added boilerplate.

There might be a slight advantage in saving the constant header name somewhere, and reusing it:

    customLanguageHeader = new HttpHeaderName("Custom-Language");
    ...
    response.addHeader(customLanguageHeader, 
                   new HttpHeaderValue(request.getParameter("lang")));
But that's even uglier. What might be nice to have is a way to run the validation at compile time for static strings, so that you can save validation passes at runtime while still being able to use the literal "Custom-Language" at the location of the addHeader call. Automatic casting would also be nice, so that you can just pass the naked string for an HttpHeaderName parameter and the compiler will insert the constructor. But I don't think you can do these things in Java.

For this particular language and this particular problem, it may be best to have the Response object validate all headers while it's being serialized.



If you do want to do this kind of thing in Java you can use the JSR308 checkers framework.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: