Question

I don’t quite understand why client side validation is a potential security risk or more of a security risk than server side validation? Can someone give me some scenarios?

Answer 1

Ideally you’d do both client and server side and never one or the other. If we take at look at these 3 scenarios, both is the only secure, user-friendly way to do it:

Client Side Only: As mentioned, it doesn’t take much to get around these validations if somebody wants to send malformed data to your server (such as SQL injection). NoScript won’t run the javascript validation code, and some browsers allow the user to actively change all loaded javascript and html, so a user could unhook the validation javascript from the controls.

Server Side Only: This one is more secure than Client-only by a long shot, but cuts back on user friendliness. They have to send their form to the server, have it validated and receive the error page back saying a particular field was invalid. What’s annoying is that if any of those fields were password fields, their values are not repopulated by default. For example, lets say the user didn’t input a phone number correctly in an account creation form. When the server spits back the page about how the phone number is wrong, the user will see that, correct the phone number and hit submit again, just to receive another error page about not having entered a password (and entering it again in it’s second textbox) even though that wasn’t the initial problem.

Client and Server Side: You get the security of the server side validation, something the user will be hard-pressed to interfere with, and the user friendliness of input validation without having to submit the page (whether you validate through purely local javascript or AJAX).

If you absolutely had to pick one, server side would be the way to go. But you shouldn’t ever have to pick one or the other.