2

Scenario : For some (comment) text field the server application is internally throwing errors when the field contains contains some specific characters.

Where should the removal of characters be implemented? in the client application or server?

I have tried to look at my old system engineering text book for a similar situation but can not find a case.

All I can think of is that client applications are to implement the minimum logic e.g. age, phone number fields being numeric, name fields not contain numbers ( debatable as celebrities might decide to include numbers in their legal names etc.).

In SOA architecture there could be multiple clients, then the internal data consistency of the server application is being replicated with each client application.

Being asked to remove the data submitted by the user in the client application and then submitting the modified data removes the possibility of server application receiving the original data and storing it and then processing the modified data within the server application domain context only.

I am looking for any references that either this is the correct or incorrect approach,

Improve this question
1
  • 1
    Altering data on Server side does not look like a good practice, let the Server validate data and return Errors/Notifications back to Client to correct it. Searched for a while to find any relevant article but did not find any, An article on Notification in validation written by Martin Fowler is here martinfowler.com/articles/replaceThrowWithNotification.html
    – Nazeel
    Jan 23, 2022 at 11:58

2 Answers 2

Reset to default
5

When you have a Client-Server architecture, the Server parts must never assume that the input they receive is coming from/through your Client implementation.

Always assume that the input you received on the server is coming from a hostile client implementation and validate the input accordingly on the server.

Any validation you perform on the client side is only as a convenience for your users to give them faster feedback on erroneous entries.

Improve this answer
0
3

If the server can clean the data sensibly then its fine to do so.

For example you mention phone numbers. But there are several popular ways of writing a phone number.

US Phone number:

  • 754-3010 Local
  • (541) 754-3010 Domestic
  • +1-541-754-3010 International
  • 1-541-754-3010 Dialed in the US
  • 001-541-754-3010 Dialed from Germany
  • 191 541 754 3010 Dialed from France

If your server can replace out the non numeric characters then you can accept all of these formats without complaining that the user has typed brackets or hyphens or spaces etc. After all, it doesn't change the data, its just a different format.

However, If they have left off the regional or international code that cant be solved by the server cleaning the data and you have to have a client side prompt.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.