2

I am working a project which involves back-end Restful API and single-page front-end app. I am wondering if the back-end API has to implement all sort of data validation logic , which is also to be implemented in the front end input forms?

  • 4
    There are also potential race conditions, where between multiple clients using the API at the same time, conditions validated by one client no longer hold by the time the REST command is issued. Thus, certain kinds of validation can only be done on the back end. – Erik Eidt Feb 9 '17 at 17:43
12

yes, data can be always manipulated on a client side or in transfer. you can NEVER depend on a client side validation. client side is a hacker computer side, so not safe at all. client side validation is only for a user convenience.

also as mentionad by @erik-eidt, there is potential for race condition with client side validation, ie user login name can be free (valid) when filling the online form, but already taken when submitting a bit later.

4

Its generally best to validate at all layers of your application, repeating validations if nescessary.

You generally want validation in your db because you generally want to ensure that your data is consistent and obeys certain constraints.

You should validate in the back end because usually that is where the 'truth' about the business logic lies, and validating there can save needless trips to the db to save invalid data.

Validation in the UI is the optional part, as it can be handled by the back end, which can return an error for the UI to display. However, the user experience is much better if you validate on the front end as it is quicker (no need to talk to the API)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.