3

I am working on a web app with a sign up form like below. The validations are all done client side using http://formvalidator.net/.

I am well aware that client-side validations can be bypassed, but I have currently not bothered to implement server-side validations as they are much more painful to implement and require procedural logic in the html and so on.

My reasoning is that there is actually nothing here that requires server-side validations, no file uploads or data of great importance that absolutely must be correct. If the user gives the incorrect email address then they will never receive their confirmation email, if there name is incorrect that is insignificant, and so on.

The only reason client side validations would be bypassed if the user chooses to disable javascript in which case a noscript tag can be used to tell them that the app will not work without javascript.

Are there security problems with what I am doing?

enter image description here

7
  • 1
    What client side validation have you implemented? It all depends on whether you do validation that you rely on for security. In general the importance of server-side validation is somewhat overstated, but it depends on your precise scenario. For example, email address validation may reject all XSS attack characters, and at other places in your app you don't both to do XSS escaping on email addresses. In that case doing server-side validation would be critical.
    – paj28
    Jan 27, 2014 at 17:26
  • 1
    P.S. I love the "We have no plans..." disclaimer that tries to put people at ease without actually making any commitment :-)
    – paj28
    Jan 27, 2014 at 17:27
  • @paj28 that really is not how it is meant to be interpreted :/ Maybe it should be slightly rephrased...
    – Lee
    Jan 27, 2014 at 17:55
  • @paj28 we are using Google Go, and they do context aware escaping in their templates golang.org/pkg/html/template
    – Lee
    Jan 27, 2014 at 17:59
  • "server-side validations as they are much more painful to implement and require procedural logic in the html". No. Use a modern web development framework. You should never need to put procedural logic in an HTML template to perform server-side validations (or any other server-side logic, for that matter). Templates should only be for rendering. Jan 27, 2014 at 18:56

4 Answers 4

7

The short answer is yes, you should always implement server side validations to prevent attacks. You can never trust client side applications as anything that is installed locally can be subverted by an attacker. They can also see what you are checking for, which gives them even more information with which to attack your server.

Many exploits target vulnerabilities in the underlying operating systems or supporting services, for example buffer overflows, SQL injections, and many others. Server side checks are the only way you have to prevent these types of flaws from being exploited, by verifying that input is within limits and is in the format expected. Without checks (and log messages warning on suspect inputs) you won't have any warning that someone is targeting your system, you could get hacked and never know it.

Even if you are never targeted servers side checks add another level of assurance, if you or someone else makes a change to the client side application which breaks something then server side checks can save you a huge amount of cleanup. It's well worth your time.

3
  • 1
    I don't know about you, but my first name is <script>alert('XSS is easy')</script> Jan 27, 2014 at 18:53
  • If you suffer from XSS in 2014 then you really are trying hard, almost all "view engines" auto escape for you.
    – Lee
    Jan 27, 2014 at 22:54
  • @Lee It's 2020 and XSS vulnerabilities are still very much a thing. e.g. CVE-2020-11516, and go ahead and search for more.
    – user43631
    Apr 7, 2020 at 21:20
3

It may be safe, but probably not.

It depends on why you're doing validation to begin with. And in particular: What do you do if invalid data is submitted?

If you're doing server-side validation, then you're guaranteed that only valid data gets through to your app. But if you do client-side validation, then you have no such guarantee.

There are dozens of ways to bypass client-side validation, not all of them malicious. But of course malicious intent is a big one. If any of your validations affect the operation of your app in any way, then server-side validation is not optional.

So for example, checking to see if the quantity in a shopping cart is a number: must be validated server-side. Checking to see if the password verification field matched the original: not as important if you're just ignoring the verification field on the server anyway.

1

It all depends on what you're doing with the user data.

If you're going to save user input in a database, for example, you have to properly neuter the data going into the database, or else your database is likely to be destroyed, or otherwise hacked, by user input designed to modify your sql queries.

Or for another example, if you're sending an email to a user-supplied email address, you're going to get hacked by spammers who will use your site to send unlimited amounts of spam to users of their choosing.

The bad guys think outside the box. You have to too.

1
  • You don't need to validate data before sending it to a database. You do need to escape it. You are using bound parameters for that, right? Feb 7, 2014 at 20:12
1

You are safe to skip server-side validation for that form providing you truncate excessively large inputs, use parameterized queries, and html encode the data if you ever output it.

The accepted answer states that you "should always implement server side validations to prevent attacks". For this particular form, what validations must be implemented that would be safer and more reliable than sanitization (truncation, parameterized queries, and html encoding)?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .