Is this JSR intended to be used for security purposes? If so, it would be nice to see "Mandatory Validation". Similar to how Guice throws an error if you don't specify a binding for a dependency, it would be nice to have JSR 303 have a mandatory mode and throw an error if any field doesn't have a validator configured. This biggest problem we have with validation from a security point of view is we get 99% percent of the input validated, but miss one field which opens a security hole.

Thoughts?

Michael Bailey

Interesting idea. I think this is something an annotation processor could enforce. I am not sure this can reasonably be part of the spec itself though.