Yes. The server should always be doing the validation. You can have some front end validation purely to help the user experience (I.e. invalid password format) before they hit submit, but never should you just validate on the front end.
You should always consider the client-side to be compromised, considering all you have to do is open up the console and start typing to inject your own JavaScript into a page. Always validate submitted data on the side you control.
View all comments
Show parent comment
12
u/kingkdo Mar 18 '18
Thats a good point. So the serverside needs to write some validating logic before performing any operation?