Re: To validate or not to validate: Client side validation

[Dotzero <dotzero () gmail com>]

On Tue, Apr 27, 2010 at 1:50 AM, Alexander Klimov <alserkli () inbox ru> wrote:
> On Thu, 22 Apr 2010, Dotzero wrote:
> > Doing client input validation is not irrelevant to security. If I
> > believe that I am implementing it correctly on the client then when
> > I see something that violates that input validation I can reasonably
> > assume that it is hostile and not accidental. Reducing noise is
> > certainly a benefit. What is the risk of a false positive that
> > impacts your normal users if you decide to send a reset or drop
> > route on server side input validation failures if you are also doing
> > the same input validation on the client vs not?
>
> Do you advocate to declare hostile anyone who turns JavaScript off?
>
> --
> Regards,
> ASK

It would depend on the nature of the site involved. For example, if I
am running a portal for specific clients (a controlled population such
as distributors for a manafacturer) then I might cnsider that. The
tradeoff of taking a customer support contact might be worth the
benefit of reducing attack footprint.

If I am running a general happy fun stuff portal where the goal is to
maximize page views to get ad revenues then I might choose to be less
aggressive.... although I might still consider the fact that
javascript is turned off from both a security and business
perspective. If my site requries javascript to function then I might
simply provide the person with a page that explaisn that the site
requries javascript to run.

The point I'm trying to make is that anyone who dismisses out of hand
as a broad generalization the security implications/potential benefits
of client side validation is tossing out a potential tool...depending
on the circumstances.

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------