3 ms·

> http://youmightnotneedjs.com/#form_validation http://youmightnotneedjs.com/#form_validation Interesting, but how is "form validation" through HTML, SCSS not

> http://youmightnotneedjs.com/#form_validation http://youmightnotneedjs.com/#form_validation Interesting, but how is "form validation" through HTML, SCSS not a security threat? I mean, you basically tell attackers how to brute force. I do wish more websites would use these techniques where appropriate to make the web faster, but maybe using JS is good to keep web developers employed (imagine if so much of demand were implementable via markup languages, reminds me of this post: http://harmful.cat-v.org/software/c++/I_did_it_for_you_all http://harmful.cat-v.org/software/c++/I_did_it_for_you_all).

Blahah 4y ago
Frontend form validation is not for security, it's for user experience. Backend validation is for security.
- usr1106 4y ago
  A lot of form validation can cause anything from bad user experience to making the whole service unusable. Phone numbers outside North America are not fixed length. Addresses come in many formats. The list is endless. We live in a global world. There is probably not a single site that can be sure to have only "local" users. Ask anyone who moved from one country to another or just tried to plan a bit more exotic holiday trip.
  - nephanth 4y ago
    But there are sites that explivitely ask for a "local" phone number. Maybe their automated sms system can't send to foreign numbers ? I' pretty sure that's how banks in the us operate Anyway in that case, the front-end should definitely catch it before the backend throws a fit
mbell 4y ago
Client side validation, regardless of the technology used, is a performance and UX optimization. The backend must always validate and it's this validation that matters for any sort of 'security' or data integrity issue.
wrayjustin 4y ago
As others have said, client-side validation is to assist a user with providing proper values. (Example: Did you forget to type the "@" sign in your email? Did you miss a digit in your phone number?) But also, JS client-side validation is also client side, and therefore exposes the same amount of information to an adversary. Either way, you need input validation on the backend.

Blahah 4y ago

Frontend form validation is not for security, it's for user experience. Backend validation is for security.

usr1106 4y ago
A lot of form validation can cause anything from bad user experience to making the whole service unusable. Phone numbers outside North America are not fixed length. Addresses come in many formats. The list is endless. We live in a global world. There is probably not a single site that can be sure to have only "local" users. Ask anyone who moved from one country to another or just tried to plan a bit more exotic holiday trip.
- nephanth 4y ago
  But there are sites that explivitely ask for a "local" phone number. Maybe their automated sms system can't send to foreign numbers ? I' pretty sure that's how banks in the us operate Anyway in that case, the front-end should definitely catch it before the backend throws a fit

mbell 4y ago

Client side validation, regardless of the technology used, is a performance and UX optimization. The backend must always validate and it's this validation that matters for any sort of 'security' or data integrity issue.

wrayjustin 4y ago

As others have said, client-side validation is to assist a user with providing proper values. (Example: Did you forget to type the "@" sign in your email? Did you miss a digit in your phone number?) But also, JS client-side validation is also client side, and therefore exposes the same amount of information to an adversary. Either way, you need input validation on the backend.