If a web application form contain few textbox fields. Among one should accept only 4 digit according to business logic. But it's taking more than 4 digit values. Is there any potential vulnerability here?


It depends on the backend. If the application logic validates on submit, there's no problem. The developers must implement server-side checks, because bypassing client-side protection is trivial, as the example you saw.

Client-side validation must be used only for avoid losing client time. Any and every client-side protection can be easily bypassed. Javascript, max-size, they don't matter.


Is there any potential vulnerability here?

Yes but it depends on how the data from that field is used and how (or if) it is validated and sanitised server side. For example, careless use could lead to overflow errors that might be exploitable.

Note that HTML5 includes many features for client-side validation of input fields that can help.

  • specific input types for numbers.
  • min and max attributes.
  • pattern attribute.

But you should always also do server side validation/sanitisation of data and especially take countermeasures against SQL-injection and similar attacks. client-side validation is mainly for acheiveing levels of responsiveness and user-friendliness that cannot easily be obtained with server-side processing.

  • 1
    Client-side validation must be seen only as a convenience factor, not security, as any attacker can trivially bypass any protection with ease... – ThoriumBR Mar 25 at 15:11
  • @ThoriumBR: We are in agreement on this, I specifically address this in my final paragraph. – RedGrittyBrick Mar 25 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.