Re: To validate or not to validate: Client side validation

[Dotzero <dotzero () gmail com>]

On Tue, Apr 20, 2010 at 4:27 PM, Robinson Delaugerre
<rdelaugerre () sdninternational com> wrote:
> Input validation has to be done *somewhere*, but if you do it client-side, you must do it again server side, because 
> anyone can bypass your nice js interface. So doing it client-side is just a courtesy to the user, so that it does not 
> take a back-and-forth between client and server to tell the user the email he provided doesn't contain an @.
>
> But as you mustn't rely on client validation, whether it's done or not is purely ux-based, and therefore irrelevant 
> to security in my book.
>
> I'd be interested in opposed opinions though..
>
> Rob'

You asked for opposed opinions, you got one <G>!

Doing client input validation is not irrelevant to security. If I
believe that I am implementing it correctly on the client then when I
see something that violates that input validation I can reasonably
assume that it is hostile and not accidental. Reducing noise is
certainly a benefit. What is the risk of a false positive that impacts
your normal users if you decide to send a reset or drop route on
server side input validation failures if you are also doing the same
input validation on the client vs not? Now I'm making a slight leap
and assuming that the input validation is being impleneted correctly
in both places. If not you are providing an opportunity for the
malicious individual to examine this particular defense without ever
hitting your server.

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------