4 ms·

Great question. I would usually prefer server side validation, and with the nice integration that Rails provides between form errors and validations on the mod

by why-el 14y ago

Great question. I would usually prefer server side validation, and with the nice integration that Rails provides between form errors and validations on the model, I am not sure how I can use this. Does anybody who uses a Rails stack combine both server side and client side validations?

mjs7231 14y ago
From a Django background which also provides form errors very easily, it seems at first glance that this would not be needed (and it technically isn't). However, it's often nice to the user to let them know of silly mistakes like passwords not matching or invalid emails before they hit submit and get bombarded with everything at once. Javascript validation provides convenience, not security.
rquantz 14y ago
I usually use both for anything public facing. Server side is for security, client side is for UX. keeping it dry is a problem, obviously, but you don't always want the same validations server- and client-side.
rpackard 14y ago
Adding client side validations offloads some work from your servers. It could reduce the number of total requests that hit your server and overall increase your speed. This may be premature optimization for a lot of cases but for form heavy apps this could be a useful optimization. Also saving a round trip to the server can make the UX seem snappier and overall give a better user experience.
lnanek2 14y ago
I thought it was standard to have both. Server side validation to keep bad data out and client side validation to provide a nicer UX for the user than a complete page reload and them searching around for what went wrong.
- dinkumthinkum 14y ago
  Yeah, for some reason people always bring up server side validation on these kinds of posts about client side validation ... doesn't server side validation go without saying?
  - vidarh 14y ago
    You'd think it goes without saying, but I've seen enough code where people didn't. Including code where the client side JS validation was pretty much a guide to hacking the site (trying in vain to protect against SQL injection attacks in one of the most horrific examples, where the SQL injection checks essentially told you exactly what to try to post directly to their server...)

by why-el 14y ago

mjs7231 14y ago

From a Django background which also provides form errors very easily, it seems at first glance that this would not be needed (and it technically isn't). However, it's often nice to the user to let them know of silly mistakes like passwords not matching or invalid emails before they hit submit and get bombarded with everything at once. Javascript validation provides convenience, not security.

rquantz 14y ago

I usually use both for anything public facing. Server side is for security, client side is for UX. keeping it dry is a problem, obviously, but you don't always want the same validations server- and client-side.

rpackard 14y ago

Adding client side validations offloads some work from your servers. It could reduce the number of total requests that hit your server and overall increase your speed. This may be premature optimization for a lot of cases but for form heavy apps this could be a useful optimization. Also saving a round trip to the server can make the UX seem snappier and overall give a better user experience.

lnanek2 14y ago

I thought it was standard to have both. Server side validation to keep bad data out and client side validation to provide a nicer UX for the user than a complete page reload and them searching around for what went wrong.

dinkumthinkum 14y ago
Yeah, for some reason people always bring up server side validation on these kinds of posts about client side validation ... doesn't server side validation go without saying?
- vidarh 14y ago
  You'd think it goes without saying, but I've seen enough code where people didn't. Including code where the client side JS validation was pretty much a guide to hacking the site (trying in vain to protect against SQL injection attacks in one of the most horrific examples, where the SQL injection checks essentially told you exactly what to try to post directly to their server...)