{"id":23,"date":"2024-08-24T11:10:12","date_gmt":"2024-08-24T10:10:12","guid":{"rendered":"https:\/\/contentlabstudy.com\/soft\/?p=23"},"modified":"2026-09-24T21:15:28","modified_gmt":"2026-09-24T20:15:28","slug":"defensive-programming","status":"publish","type":"post","link":"https:\/\/contentlabstudy.com\/soft\/defensive-programming\/","title":{"rendered":"Defensive Programming"},"content":{"rendered":"

Defensive programming<\/strong> is writing code that assumes inputs, clocks, disks, and other teams will lie. It is not \u201cnull-check everything\u201d and not \u201cnever throw.\u201d It is making implicit contracts explicit and failing in a way the caller can handle.<\/p>\n

Trust boundaries<\/h2>\n

Draw the line: HTTP body, queue payload, file, environment, clock, \u201cthe other microservice.\u201d Inside the line, prefer types that cannot represent illegal states. At the line, parse \u2014 do not cast.<\/p>\n

\/\/ untrusted\nvar raw = request.Query[\"page\"];\nif (!int.TryParse(raw, out var page) || page < 1 || page > 1000)\n    return Results.BadRequest();\n<\/code><\/pre>\n
Do not sprinkle int.Parse<\/code> on query strings and hope.<\/p>\n
Make illegal states unrepresentable<\/h2>\n
Replace boolean flags that contradict each other with a discriminated union or a small enum. An Order<\/code> that is both Cancelled<\/code> and Shipped<\/code> is a bug factory. In C#, records + required members + private constructors beat public setters on every field.<\/p>\n
sealed class FlaggedOrder\n{\n    public bool IsShipped { get; set; }\n    public bool IsCancelled { get; set; } \/\/ both can be true\n}\n\nenum OrderStatus { Placed, Shipped, Cancelled }\n\nsealed record StatusOrder(OrderStatus Status);<\/code><\/pre>\n
FlaggedOrder<\/code> can be shipped and cancelled at once. StatusOrder<\/code> cannot.<\/p>\n
Fail closed vs fail open<\/h2>\n
Authorization, payments, and privacy: fail closed<\/strong> (deny if unsure). Observability and optional recommendations: fail open with a metric. Defaulting \u201callow\u201d on a missing role claim is an incident.<\/p>\n
Assertions, not business control flow<\/h2>\n
Use assertions \/ Debug.Assert<\/code> \/ \u201cthis is a programmer error\u201d exceptions for broken invariants (null repository in a composition root). Use domain results or HTTP 4xx for user-fixable mistakes. Catching Exception<\/code> around a whole request and returning 200 hides outages.<\/p>\n
Timeouts, cancellation, idempotency<\/h2>\n
Pass CancellationToken<\/code>. Honor it in I\/O. Treat client disconnect as cancel, not as \u201ckeep writing the report.\u201d For handlers that may run twice (at-least-once queues, user double-submit), store an idempotency key. See reliability patterns<\/a>.<\/p>\n
What breaks it<\/h2>\n
The catch turns a downed gateway into HTTP 200. Delete it: the fault stays a 500. Return a 4xx only for input the caller can fix.<\/p>\n
static IResult HideTheFault()\n{\n    try\n    {\n        throw new InvalidOperationException(\"gateway down\");\n    }\n    catch (Exception)\n    {\n        return Results.Ok();\n    }\n}<\/code><\/pre>\n
Pitfalls<\/h2>\n