In my code, the first AJAX call to the server checks the recaptcha and sanitises the data.

Is there a way for a malicious user to skip that process ?

Since this is client side javascript, could he just fill in the email and the password in the Firebase user creation code by editing the code ?

Actually, can the user edit my client side code to skip my protection mechanisms ?

$("#registerForm").submit(function(e) {

        var username = $("#username").val();
        var email = $("#email").val(); 
        var password = $("#password").val(); 
        var confirmPassword = $("#confirmPassword").val();
        var referer = $("#referer").val();

        $this = $(this);
            type: "POST",
            url: "register",
            data: $this.serialize()
        }).done(function(data) {

            if (data) {

                    firebase.auth().createUserWithEmailAndPassword(data.email, data.password).then(userData => {

                            type: "POST",
                            url: "register2",
                            data: userData.serialize()
                        }).done(function(result) {
                           if (result == "WORKED!") {
                                localStorage.setItem('success_msg_local', "Please check your inbox. You have 1 hour to confirm your email address. Failing to do so will delete the account and let you register again.");
                           else if (result == "FAILED1!") {
                               firebase.auth().signOut().then(function() {
                                   localStorage.setItem('error_msg_local', 'Failed to Register. Try again.');
                           else if (result == "FAILED2!") {
                                firebase.auth().signOut().then(function() {
                                     localStorage.setItem('error_msg_local', 'Failed to Register. An error occured. Please try again later.');

                    },function(error) {
                            var errorCode = error.code;
                            var errorMessage = error.message;
                            ("ERROR 3: "+ errorCode +" "+errorMessage);
                            localStorage.setItem('error_msg_local',  'Failed to Register. Please wait 1 hour before trying again.');
            else {
                localStorage.setItem('error_msg_local',  'Recaptcha failed'); window.location.href = "/users/register";

        }).fail(function( jqXHR, textStatus ) {
            alert( "Request failed: " + textStatus );

  • 2
    I would't rely solely on client side script to perform sanitisation, the user can remove and edit code as they wish. In a proxy like Fiddler or Burp, I can intercept the request and swap out your sanitised data for whatever i like. Your server side should code should be responsible for making sure data is safe.
    – iainpb
    Jun 12, 2017 at 12:00
  • @SteffenUllrich Hi ! This is actually different: I am doing server side validation, just wondering if it can be circumvented because there are 2 calls instead of one. The question you point to is referring to a situation where one might do client validation which is not my case. Jun 12, 2017 at 12:02
  • @TheProgrammer: you are right. I've retracted the vote. Jun 12, 2017 at 12:05
  • @iain Just to make sure I understand: currently, validation is done on the server by hitting my endpoints with AJAX. What you are telling me is that regardless of this, a malicious user could swap the AJAX response data with whatever he wants ? Jun 12, 2017 at 12:05
  • 1
    If you're relying on data which has been sent back to the client being returned without tampering, and you've not got a verification method (e.g. HMAC) to check this, then the initial step is effectively pointless, from a security POV (it's helpful from a UX POV). You need to validate at the point of submission, on the server, or prevent the client from modifying the submission between sanitisation and submission. You can't rely on client side code to prevent that though.
    – Matthew
    Jun 12, 2017 at 12:13

1 Answer 1


You can never be sure of what happens client side. The client could just be a netcat session, or a Python script that will send forged HTTP requests to your server. Simulating Ajax calls is indeed a nightmare, but after spying some normal browser exchanges with the debugging tools of a browser and/or a network spy like wireshark, it possible if not easy to pass forged requests to the server.

I cannot answer formally yes to the question could [the client] just fill in the email and the password in the Firebase user creation code by editing the code ?, because I'm neither an Ajax nor a Firebase expert. But I am pretty sure that any client side protection mechanism can be by passed after some work.

So the only secure way is to put as much sanitization as you can in client Ajax code, because what is done client side gives a nice user experience and causes no load on server, but to always write a full control server side, assuming that any client verification could have been by-passed.

  • All right, this is a nice explanation :) But it does not solve the problem expressed in my question :D Jun 12, 2017 at 15:38
  • I know. Which is a not a solution, it just states that my code is not secure thus not answering the question : "Can a user tamper with my client side code to skip HTML sanitization, if yes, how can I prevent it?" Jun 12, 2017 at 16:04
  • @TheProgrammer:I've edited my post with server side verification. Jun 12, 2017 at 17:55
  • Again, I need the register Firebase call to be client side, which means that I need the first ajax call to sanitise the data that is used by the firebase register function. You exlained that this was useless since that data could easily be changed between the first Ajax call and the register function. You have not offered a solution to the problem yet. If I put everything in the second AJAX call, the user willl be created using unverified inputs. Jun 12, 2017 at 19:18
  • So, again: what is your solution ? I really don't know what to do :/ Jun 12, 2017 at 19:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .