Never Trust the Client

The client is not on your side.

Not because your users are bad,
but because you don't control
what reaches your server.

Anything that runs on their machine
can be changed, replayed, faked.
The dropdown you limited to three options
can send a fourth.
The field you marked required
can arrive empty.
The price you set in JavaScript
can arrive as a penny.

Validation in the browser
is a courtesy to honest users.
It is not security.

Every rule that actually matters
has to be enforced again
on the server,
where you're the one holding the keys.

Treat every request
as if a stranger wrote it,
because sometimes
a stranger did.

Check it on the client to be kind.
Check it on the server to be safe.

Never trust the client.
Trust what you can verify.

– Serguey Asael Shinder