HTTP and validation

GET retrieves state and should not mutate it. POST creates a resource or submits a form. PUT replaces the editable state at a known resource URL. DELETE removes it. HTML forms natively use GET and POST; the Thymeleaf lab uses POST routes for update and delete. JSON clients can send PUT and DELETE directly.

Client validation improves usability, while server validation protects the contract. @NotBlank rejects empty titles, @Size caps length, @Email checks email shape, and @NotNull rejects missing required values. @Valid triggers validation. A validation annotation on a field alone does not make every method call validate automatically.

400 means invalid request, 401 means authentication is missing or invalid, 403 means the authenticated request lacks access, 404 means the resource is not available, and 409 means a conflict such as a duplicate email. The personal application deliberately uses 404 for foreign-owned todo ids.