DEV Community

loading...

Discussion on: Securing a Webapp - Step 1: Start As You Mean To Go On

Collapse
dotnetcoreblog profile image
Jamie Author

Exactly this.

NEVER trust data from the client.

Collapse
exadra37 profile image
Paulo Renato

Client: is the application making the request to the server. This can be a web app, a mobile app, a script, or a tool like Postman.

The server cannot trust data from the client, but if you only do validation in the client side, your web app, then your server is trusting in client data.

For me the message you are passing is that once you validate the data the user inputs on the client side, then the server doesn't necessarily need to check it again, and this his why I said that is a suicide.

Thread Thread
dotnetcoreblog profile image
Jamie Author

It's interesting that you thought that, because the next paragraph goes on to say that you should use server side validation. And the paragraph after that talks about database side validation.

I may have to revise my statement so that it's clear that you should use all three.