4 ms·

I wonder how many backends are just pure CRUD with all business rules implemented on the frontend? Scary to think. I'm forever having to tell devs that form val

I wonder how many backends are just pure CRUD with all business rules implemented on the frontend? Scary to think. I'm forever having to tell devs that form validation in js isn't enough, you need to do it on the backend too (or, preferably, only). This article is about reading data you shouldn't be able to, but my strong suspicion is a bunch of stuff out there will let you write stuff you shouldn't be able to as well.

Etheryte 2y ago
Not sure I agree with the idea that you should validate only on the backend, I think you should do both. Backend validation is for you, to ensure that the data is valid and sane, frontend validation is for the user, so they can get early feedback if something is wrong.
- globular-toast 2y ago
  You can do basic validation on the frontend. The problem is if you do too much you end up with two sets of, possibly subtly different, rules that you need to maintain.
  - tgv 2y ago
    In many cases, that's better than having it done only on the backend, because it would confuse (and anger) users. "It knows this isn't correct, why does it let me do it and then say 422 SCNUKS"?
    - whiterknight 2y ago
      You don’t return readable errors from backend to user? You don’t wait for requests to confirm before assuming they do?
      - ongy 2y ago
        For something like input field validation, a request per keystroke might be a bit much, but the update rate of feedback users expect. In systems with frontend UX validation and backend functional validation, errors from the backend tend to be aimed at devs. I.e. might expose the reflex that's known good over having nice words for the approximate test done in the frontend.
      - tgv 2y ago
        Then the code duplication problem moves to the back-end. And it's not the best place for readable error messages.

4 ms·

I wonder how many backends are just pure CRUD with all business rules implemented on the frontend? Scary to think. I'm forever having to tell devs that form val

by globular-toast 2y ago

Etheryte 2y ago
Not sure I agree with the idea that you should validate only on the backend, I think you should do both. Backend validation is for you, to ensure that the data is valid and sane, frontend validation is for the user, so they can get early feedback if something is wrong.
- globular-toast 2y ago
  You can do basic validation on the frontend. The problem is if you do too much you end up with two sets of, possibly subtly different, rules that you need to maintain.
  - tgv 2y ago
    In many cases, that's better than having it done only on the backend, because it would confuse (and anger) users. "It knows this isn't correct, why does it let me do it and then say 422 SCNUKS"?
    - whiterknight 2y ago
      You don’t return readable errors from backend to user? You don’t wait for requests to confirm before assuming they do?
      - ongy 2y ago
        For something like input field validation, a request per keystroke might be a bit much, but the update rate of feedback users expect. In systems with frontend UX validation and backend functional validation, errors from the backend tend to be aimed at devs. I.e. might expose the reflex that's known good over having nice words for the approximate test done in the frontend.
      - tgv 2y ago
        Then the code duplication problem moves to the back-end. And it's not the best place for readable error messages.