11

Do you use both Client-side and Server-side validation techniques side by side when validating input from a user, e.g. via a contact form?

If so, is it really necessary? Are you over engineering?

Improve this question
1

5 Answers 5

Reset to default
28

Yes, and you should.

This maintains instant user feedback without wasted postbacks whilst also guarding against users disabling JavaScript.

This is how the ASP.NET Validation Controls work.

It is certainly not over-engineering as using one without the other has drawbacks.

Improve this answer
4
  • 8
    +1. No excuse for not having server side validation imo.
    – DBlackborough
    Commented Mar 1, 2011 at 11:26
  • 12
    Server side is necessary, client side is convenience. In web applications you can't count on client side validation.
    – BillThor
    Commented Mar 1, 2011 at 15:58
  • @BillThor - Yup thats exactly right
    – billy.bob
    Commented Mar 1, 2011 at 16:00
  • intelligent users can definitely abuse your app if you do not have client side validation
    – Umair Ayub
    Commented Apr 12, 2019 at 7:35
7

If so, is it really necessary?

Yes.

Are you over engineering?

No.

Front-end validation can give immediate feedback if it's a rich interface.

Back-end can be used by multiple front-ends. And it's the only validation for the HTML-only (no javascript) fall-back plan.

Improve this answer
7

One of the first fundamentals that I learnt about security was that hackers will never use your UI.

Any client side validation can normally be easily bypassed in web apps if they have their own local version of your form and then submit it back to your server.

Client side validation is great though for improving your user experience and reducing unnecessary round trips to the server to perform validation.

Improve this answer
1
  • +1, I've seen to many examples where validation was done entirely on the client side
    – Karl
    Commented Mar 1, 2011 at 14:16
2

Server side validation should be the bare minimum.

And for input that is likely to be wrong, you should also add a client side check..

For example: check if the email is correctly formatted on both the client and server side but checking if it's unique could be a server side check.

Improve this answer
2
  • 1
    "Checking it's unqiue" is verification NOT validation so this doesn't apply. Understand the difference.
    – billy.bob
    Commented Mar 1, 2011 at 11:37
  • 2
    Did you even read what you post? Checking that email is unique is validation. Cheking, say, that email and password are valid credentials is verification. In any case, it is just a terminology issue.
    – Andrea
    Commented Mar 1, 2011 at 13:57
2

Yes, It's not a bad idea to use both. If simple user input errors can be caught on client side then it makes sense to tell user about those errors before sending data and bugging down your server. For example if user entered something that does not look like an email address in the 'email' field or entered a string of only 5 chars long in the password field and you know your site required the password to be at least 6 chars long, then you should tell the user about it before sending anything to the server.

It's important to also duplicate exact same validation on the server for 2 reasons: 1) what if user has Javascript disabled?

2) User maliciously tried to bypass your client-side validation, which is really easy.

Improve this answer
0

Not the answer you're looking for? Browse other questions tagged or ask your own question.