DEV Community

Discussion on: DO NOT trust your frontend validators

Collapse
 
joelbonetr profile image
JoelBonetR 🥇 • Edited
Phone numbers would be written like; "John Doe", or "foo@bar.com".

The dev throwing raw queries directly into the database:

😂😂😂😂

I agree 100% on the topic, front-end validations were always for convenience and there's not one but two reasons for adding validations in the client side as I already commented here:

Yes sure!
The same way you can disable JS in your browser, send a request using Postman directly to the endpoint or anything else.

Client code is loaded and running inside third party machines, hence you can't rely in frontend validations in any app. You'll need to re-validate the whole in backend anyway.

Validations in the frontend have 2 purposes:

  1. Give feedback to the user as soon as possible.
  2. Avoid requests to your server if the data that the user is about to send is not valid.

So yes, it's usable in a real product. If you do that and submit wrong data, the backend will throw an error about that and we should be good 😂

Original post for reference.

So at the end, the benefits are better UX and saving costs and server load of the requests that will necessarily fail in the back-end validation.

Collapse
 
polterguy profile image
Thomas Hansen

Word!! ^_^

However, what I find difficult is the fact that when using frontend validation, the code duplicates. As I update code, I've got two places I need to touch, possibly two different roles on my team too, to ensure they're both applying the correct changes. However, I do (mostly) agree on that frontend validation is necessary - Just don't TRUST it ... :)

Collapse
 
joelbonetr profile image
JoelBonetR 🥇

Yes sure! the same way that adding a column in the database (DATA) also demands some changes in the server (BACK-END) and in any client consuming this information (FRONT-END).

I hear a noise far away that says "Decouple your system building blooooocks!"
Wait I'm hearing something else "*slap* Dependencieeeees!"

Never mind, must have been the wind 😁

Thread Thread
 
polterguy profile image
Thomas Hansen

Hahahahaha :D

Well, there is a difference, because one is duplicating logic, while the other is not really duplicating things, but simply allowing for field to move back and forth - But I see your point ^_^

Thread Thread
 
joelbonetr profile image
JoelBonetR 🥇

Well it's like in security at the end, you've different layers (data security, endpoint security, application security network Security...) and at the end you won't be trusting any 😅 and develop a contingency plan "just in case" everything fails.

If we going strict, you don't need to add validations in frontend "as is", just in the backend; But if you do, you earn the benefits (lower cost by lowering the requests and happier customers) so it's not doing job for nothing 😁

Thread Thread
 
polterguy profile image
Thomas Hansen

I agree, I guess I'm just spoiled with Hyperlambda HTTP requests never using more than 100ms before returning ... ;)