0

Users can interfere with any piece of data transmitted between the client and the server, including request parameters, cookies, and HTTP headers. Where is the best way to filter user input, on the client side or in the server side ?

If the filtering happening on the client side, users can look at filter implementation and then it can easily circumvented. But what's about the server side ?

  • @tlng05 No, it is not explains what is the problem in the client side. – skiduser1234 Jul 25 at 21:31
  • 1
    @skiduser1234: there is no need to explain what the problem is with client side filtering since you've already explained the problem yourself in your question: "If the filtering happening on the client side, users can look at filter implementation and then it can easily circumvented.". – Steffen Ullrich Aug 1 at 18:09
1

It depends on what you mean by "the best".

From the security point of view, server should not trust any data received from the client and should validate all the data. Why? Because you don't know who and why sent these data. May be user has modified your JavaScript and forced browser to send to the server the data, that you believed your script should have filtered. Or may be there is an attacker that created an application, that sends data that you have never expected from your script.

From the point of view of good user experience, the application (web site) should inform the user about incorrect input as soon as possible. That's why it makes sense to implement some validation and correction on the client, for instance, validation of telephone number or validation of date. On the server side you should still validate everything, including any data validated on the client.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.