4 ms·

Apps are built in a client-server configuration where the app is the user facing client and the API is the server. If you listen and manipulate the data sent ba

by tmpz22 5y ago

Apps are built in a client-server configuration where the app is the user facing client and the API is the server. If you listen and manipulate the data sent back and forth to the server you can often do a lot more then what the user interface allows. Whether that’s gathering and analyzing more data or completing actions the server developers never anticipated the client would attempt. Simply put backend developers assume the client will only do what they configure it to do and won’t be tampered with, except with enough effort it can trivially be tampered with.

h0l0cube 5y ago
> backend developers assume the client will only do what they configure ... if they lack the time (or inclination) to validate the requests properly. Client side validation is important for good UX, but not strictly essential, whereas server side validation ought to be mandatory.
- mandelbrotwurst 5y ago
  “We should probably ______ , but _____ ...”
- tmpz22 5y ago
  Put more generously there are limitations to the apple development ecosystem and frameworks, and limitations to web frameworks. Combined you combine both sets of limitations - which encourage the developers to throw their hands up. Release engineering mobile apps is a PITA. Backend engineering at a mobile first company is often second fiddle.
  - h0l0cube 5y ago
    I'm not sure how Apple's ecosystem or web frameworks limit the validation on a backend, which is pretty much platform agnostic. The limitations are bound by what a HTTP response can provide, and the error states the front-end devs are willing to handle. During my time as a mobile/web dev, the back-end devs were always compliant with providing the error information where relevant, and would enforce business requirements (e.g., paid users are only authorized to do 'x') on the back-end. Once again, it's more expedient to not care, but I think Bumble has the budget and self-interest to care for the examples in the article.

by tmpz22 5y ago

h0l0cube 5y ago

> backend developers assume the client will only do what they configure ... if they lack the time (or inclination) to validate the requests properly. Client side validation is important for good UX, but not strictly essential, whereas server side validation ought to be mandatory.

mandelbrotwurst 5y ago
“We should probably ______ , but _____ ...”
tmpz22 5y ago
Put more generously there are limitations to the apple development ecosystem and frameworks, and limitations to web frameworks. Combined you combine both sets of limitations - which encourage the developers to throw their hands up. Release engineering mobile apps is a PITA. Backend engineering at a mobile first company is often second fiddle.
- h0l0cube 5y ago
  I'm not sure how Apple's ecosystem or web frameworks limit the validation on a backend, which is pretty much platform agnostic. The limitations are bound by what a HTTP response can provide, and the error states the front-end devs are willing to handle. During my time as a mobile/web dev, the back-end devs were always compliant with providing the error information where relevant, and would enforce business requirements (e.g., paid users are only authorized to do 'x') on the back-end. Once again, it's more expedient to not care, but I think Bumble has the budget and self-interest to care for the examples in the article.