3

I am working on a web app with a sign up form like below. The validations are all done client side using http://formvalidator.net/.

I am well aware that client-side validations can be bypassed, but I have currently not bothered to implement server-side validations as they are much more painful to implement and require procedural logic in the html and so on.

My reasoning is that there is actually nothing here that requires server-side validations, no file uploads or data of great importance that absolutely must be correct. If the user gives the incorrect email address then they will never receive their confirmation email, if there name is incorrect that is insignificant, and so on.

The only reason client side validations would be bypassed if the user chooses to disable javascript in which case a noscript tag can be used to tell them that the app will not work without javascript.

Are there security problems with what I am doing?

enter image description here

  • 1
    What client side validation have you implemented? It all depends on whether you do validation that you rely on for security. In general the importance of server-side validation is somewhat overstated, but it depends on your precise scenario. For example, email address validation may reject all XSS attack characters, and at other places in your app you don't both to do XSS escaping on email addresses. In that case doing server-side validation would be critical. – paj28 Jan 27 '14 at 17:26
  • 1
    P.S. I love the "We have no plans..." disclaimer that tries to put people at ease without actually making any commitment :-) – paj28 Jan 27 '14 at 17:27
  • @paj28 that really is not how it is meant to be interpreted :/ Maybe it should be slightly rephrased... – Lee Jan 27 '14 at 17:55
  • @paj28 we are using Google Go, and they do context aware escaping in their templates golang.org/pkg/html/template – Lee Jan 27 '14 at 17:59
  • "server-side validations as they are much more painful to implement and require procedural logic in the html". No. Use a modern web development framework. You should never need to put procedural logic in an HTML template to perform server-side validations (or any other server-side logic, for that matter). Templates should only be for rendering. – Stephen Touset Jan 27 '14 at 18:56
6

The short answer is yes, you should always implement server side validations to prevent attacks. You can never trust client side applications as anything that is installed locally can be subverted by an attacker. They can also see what you are checking for, which gives them even more information with which to attack your server.

Many exploits target vulnerabilities in the underlying operating systems or supporting services, for example buffer overflows, SQL injections, and many others. Server side checks are the only way you have to prevent these types of flaws from being exploited, by verifying that input is within limits and is in the format expected. Without checks (and log messages warning on suspect inputs) you won't have any warning that someone is targeting your system, you could get hacked and never know it.

Even if you are never targeted servers side checks add another level of assurance, if you or someone else makes a change to the client side application which breaks something then server side checks can save you a huge amount of cleanup. It's well worth your time.

  • 1
    I don't know about you, but my first name is <script>alert('XSS is easy')</script> – Stephen Touset Jan 27 '14 at 18:53
  • If you suffer from XSS in 2014 then you really are trying hard, almost all "view engines" auto escape for you. – Lee Jan 27 '14 at 22:54
3

It may be safe, but probably not.

It depends on why you're doing validation to begin with. And in particular: What do you do if invalid data is submitted?

If you're doing server-side validation, then you're guaranteed that only valid data gets through to your app. But if you do client-side validation, then you have no such guarantee.

There are dozens of ways to bypass client-side validation, not all of them malicious. But of course malicious intent is a big one. If any of your validations affect the operation of your app in any way, then server-side validation is not optional.

So for example, checking to see if the quantity in a shopping cart is a number: must be validated server-side. Checking to see if the password verification field matched the original: not as important if you're just ignoring the verification field on the server anyway.

1

It all depends on what you're doing with the user data.

If you're going to save user input in a database, for example, you have to properly neuter the data going into the database, or else your database is likely to be destroyed, or otherwise hacked, by user input designed to modify your sql queries.

Or for another example, if you're sending an email to a user-supplied email address, you're going to get hacked by spammers who will use your site to send unlimited amounts of spam to users of their choosing.

The bad guys think outside the box. You have to too.

  • You don't need to validate data before sending it to a database. You do need to escape it. You are using bound parameters for that, right? – Mr. Shiny and New 安宇 Feb 7 '14 at 20:12
1

You are safe to skip server-side validation for that form providing you truncate excessively large inputs, use parameterized queries, and html encode the data if you ever output it.

The accepted answer states that you "should always implement server side validations to prevent attacks". For this particular form, what validations must be implemented that would be safer and more reliable than sanitization (truncation, parameterized queries, and html encoding)?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.