Is there a way to add automatic validation to all parameters? Like there is no place where I would w...

# graphql-kotlin

[jmfayard]

Is there a way to add automatic validation to all parameters?
Like there is no place where I would welcome to receive an input like <script>alert('got you, LOL')</script>

[Arnab]

That sounds like a job for instrumentation.
https://www.graphql-java.com/documentation/instrumentation#field-validation-instrumentation

[Dariusz Kuc]

you could also use javax.validation to annotate your arguments and input objects -> example from spring https://github.com/ExpediaGroup/graphql-kotlin/blob/master/examples/server/spring-[…]diagroup/graphql/examples/server/spring/query/ValidatedQuery.kt

[jmfayard]

I'm currently using javax.validation but I don't want to add it to all the fields

[jmfayard]

I will have a look at field validation instrumentation thanks!

[Dariusz Kuc]

con of using javax.validation and instrumentations is that it hides this info from the user

[Dariusz Kuc]

you could also use directives to convey some of that validation info to the users and/or custom scalars

[Dariusz Kuc]

that being said -> introspection (as opposed to SDL) doesn't show the directives 😞 so tools like graphiql/playground won't show it

there is an ongoing discussion on how to tackle this in the spec...

[Arnab]

I think it’s important to mention that if you decide that a field is of type String and you never want strings containing a certain regex, then that is up to you as the developer to communicate that to the user. I don’t see GraphQL being opinionated about that.

[Dariusz Kuc]

I think custom scalar would be better in that case as you can provide @specifiedBy information on it