Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Suppose I have a form, and one of this form inputs I set the max length to 15:
<input type="text" name="username" maxlength="15">
Now the attacker wants to override this limit, to do that he will simply fire "Inspect element", click on the input, change the value from 15 to 200.
My question here, is there a better way to set the max allowed characters for html forms?
The "better way" is server-side validation, because you simply cannot control what the client will send. It does not matter what client-side method you use - <input maxlength=, javascript, what-have-you.
To quote OWASP:
Note that client side validation is a fine idea for performance and usability, but it has no security benefit whatsoever. Server side checks are required to defend against parameter manipulation attacks.
See also this answer which lays the difference out nicely.
Nope. That's pretty much the best you can do on the client. The key is to have strong input validation on the server. Always treat all input as suspicious.
Input validation on the client is to improve the user experience. The security happens on the server.
PS: You could add JavaScript validation but it adds no real security because an attacker can bypass your web app completely and send malicious requests.
