5 ms·
Everything has to be validated on the server side simply for security reasons. Even if you do all validation on the client side, which prevents the users submit
by nagyf 3y ago
Everything has to be validated on the server side simply for security reasons.
Even if you do all validation on the client side, which prevents the users submitting a form with invalid data, an attacker can work around that. e.g. submitting the form with valid data, but intercepting the request and modifying the values there. Or simply just using curl with malicious/invalid data.
You still need the client side validation for UX. The regular users needs to know if they messed up someting in the form. Also it's a much better UX if it's done on the client side, without the need to send an async request for validations.
- emodendroket 3y agoYeah but that doesn't answer why you can't share validators between the backend and the frontend if both are written in the same language.
- yawaramin 3y agoBecause HTML form validation is a built-in native feature of HTML, and it's integrated in the browser: <input type="email" required placeholder="Please enter your email address"> Constantly reinventing the wheel in every app is silly.
- emodendroket 3y agoThese validators are rather limited and you’ll end up needing JavaScript for any Web app with anything beyond the simplest requirements.
- yawaramin 3y agoThey're limited in some ways but they're just about powerful enough to do almost everything you'd need or want to do client-side without making a network request. In my opinion it doesn't make sense to try to fit in tons of complex validation logic in the frontend.
- emodendroket 3y agoWhy make a round trip if you don’t have to?
- PaulHoule 3y agoSome kinds of validation really do need the round trip. If somebody is choosing a user name on a sign up for you do need to do a database lookup. If your back end is fast and your HTML is lean, backend requests to validate can complete in less time than any of the 300 javascript, CSS, tracker, font, and other requests that a fashionable modern webapp does for no good reason... It's true though that many back ends are run on the cheap with slow programming languages and single-thread runtimes like node.js that compete with slow javascript build systems to make people think slow is the new normal.
- emodendroket 3y agoYeah, obviously if it requires I/O you can’t write it client side, but the argument here seems to be in favor of doing validation only server-side even when it could also be done client-side.
- yawaramin 3y agoWhy be on the internet at all? Why not distribute a desktop app that doesn't need any connectivity at all?
- emodendroket 3y agoPresumably there are some features of the app that won’t work that way. Surely you’re not saying you prefer a Web app just for the sake of making calls.
- yawaramin 3y agoNo, I'm just taking your argument to its logical conclusion. If you manufacture enough criteria, you can steer any discussion so that your choice is the only possible choice left. That's not how things work in reality, there are many competing factors that go into technological choices.