Can a user tamper with my client side code to skip HTML sanitization, if yes, how can I prevent it?

Question

In my code, the first AJAX call to the server checks the recaptcha and sanitises the data.

Is there a way for a malicious user to skip that process ?

Since this is client side javascript, could he just fill in the email and the password in the Firebase user creation code by editing the code ?

Actually, can the user edit my client side code to skip my protection mechanisms ?

$("#registerForm").submit(function(e) {

        e.preventDefault();
        var username = $("#username").val();
        var email = $("#email").val(); 
        var password = $("#password").val(); 
        var confirmPassword = $("#confirmPassword").val();
        var referer = $("#referer").val();

        $this = $(this);
        $.ajax({
            type: "POST",
            url: "register",
            data: $this.serialize()
        }).done(function(data) {

            if (data) {

                    firebase.auth().createUserWithEmailAndPassword(data.email, data.password).then(userData => {

                        $.ajax({
                            type: "POST",
                            url: "register2",
                            data: userData.serialize()
                        }).done(function(result) {
                           if (result == "WORKED!") {
                                localStorage.setItem('success_msg_local', "Please check your inbox. You have 1 hour to confirm your email address. Failing to do so will delete the account and let you register again.");
                                window.location.href="/users/register";
                           }
                           else if (result == "FAILED1!") {
                               firebase.auth().signOut().then(function() {
                                   localStorage.setItem('error_msg_local', 'Failed to Register. Try again.');
                                   window.location.href="/users/register";
                               });  
                           }
                           else if (result == "FAILED2!") {
                                firebase.auth().signOut().then(function() {
                                     localStorage.setItem('error_msg_local', 'Failed to Register. An error occured. Please try again later.');
                                     window.location.href="/users/register";
                                });
                           }
                        });

                    },function(error) {
                            var errorCode = error.code;
                            var errorMessage = error.message;
                            ("ERROR 3: "+ errorCode +" "+errorMessage);
                            localStorage.setItem('error_msg_local',  'Failed to Register. Please wait 1 hour before trying again.');
                            window.location.href="/users/register";
                    });
            }
            else {
                localStorage.setItem('error_msg_local',  'Recaptcha failed'); window.location.href = "/users/register";
            }

        }).fail(function( jqXHR, textStatus ) {
            alert( "Request failed: " + textStatus );
        });

    });

Answer 1

You can never be sure of what happens client side. The client could just be a netcat session, or a Python script that will send forged HTTP requests to your server. Simulating Ajax calls is indeed a nightmare, but after spying some normal browser exchanges with the debugging tools of a browser and/or a network spy like wireshark, it possible if not easy to pass forged requests to the server.

I cannot answer formally yes to the question could [the client] just fill in the email and the password in the Firebase user creation code by editing the code ?, because I'm neither an Ajax nor a Firebase expert. But I am pretty sure that any client side protection mechanism can be by passed after some work.

So the only secure way is to put as much sanitization as you can in client Ajax code, because what is done client side gives a nice user experience and causes no load on server, but to always write a full control server side, assuming that any client verification could have been by-passed.