Which is better to do client side or server side validation?
In our situation we are using
jQuery and MVC.
JSON data to pass between our View and Controller.
A lot of the validation I do is validating data as users enter it.
For example I use the the keypress event to prevent letters in a text box, set a max number of characters and that a number is with in a range.
I guess the better question would be, Are there any benefits to doing server side validation over client side?
As others have said, you should do both. Here’s why:
You want to validate input on the client side first because you can give better feedback to the average user. For example, if they enter an invalid email address and move to the next field, you can show an error message immediately. That way the user can correct every field before they submit the form.
If you only validate on the server, they have to submit the form, get an error message, and try to hunt down the problem.
(This pain can be eased by having the server re-render the form with the user’s original input filled in, but client-side validation is still faster.)
curl or from a script, for example?
(This is not theoretical; eg, I worked on a travel search engine that re-submitted the user’s search to many airlines, bus companies, etc, by sending
POST requests as if the user had filled each company’s search form, then gathered and sorted all the results. Those companies’ form JS was never executed, and it was crucial for us that they provide error messages in the returned HTML. Of course, an API would have been nice, but this was what we had to do.)
Not allowing for that is not only naive from a security standpoint, but also non-standard: a client should be allowed to send HTTP by whatever means they wish, and you should respond correctly. That includes validation.
Addendum – December 2016
There are some validations that can’t even be properly done in server-side application code, and are utterly impossible in client-side code, because they depend on the current state of the database. For example, “nobody else has registered that username”, or “the blog post you’re commenting on still exists”, or “no existing reservation overlaps the dates you requested”, or “your account balance still has enough to cover that purchase.” Only the database can reliably validate data which depends on related data. Developers regularly screw this up, but PostgreSQL provides some good solutions.
Yes, client side validation can be totally bypassed, always. You need to do both, client side to provide a better user experience, and server side to be sure that the input you get is actually validated and not just supposedly validated by the client.
I am just going to repeat it, because it is quite important:
Always validate on the server
The benefit of doing server side validation over client side validation is that client side validation can be bypassed/manipulated:
- The data could be sent directly to your server by someone who’s not even using your site, with a custom app designed to do so
In short – always, always validate server-side and then consider client-side validation as an added “extra” to enhance the end user experience.
You must always validate on the server.
Also having validation on the client is nice for users, but is utterly insecure.
Well, I still find some room to answer.
In addition to answers from Rob and Nathan, I would add that having client-side validations matters. When you are applying validations on your webforms you must follow these guidelines:
- Must use client-side validations in order to filter genuine requests coming from genuine users at your website.
- The client-side validation should be used to reduce the errors that might occure during server side processing.
- Client-side validation should be used to minimize the server-side round-trips so that you save bandwidth and the requests per user.
- You SHOULD NOT assume the validation successfully done at client side is 100% perfect. No matter even if it serves less than 50 users. You never know which of your user/emplyee turn into an “evil” and do some harmful activity knowing you dont have proper validations in place.
- Even if its perfect in terms of validating email address, phone numbers or checking some valid inputs it might contain very harmful data. Which needs to be filtered at server-side no matter if its correct or incorrect.
- If client-side validation is bypassed, your server-side validations comes to rescue you from any potential damage to your server-side processing. In recent times, we have already heard lot of stories of SQL Injections and other sort of techniques that might be applied in order to gain some evil benefits.