0

My question is about what is necessary and/or best practice.

Suppose, for example I need some text from an input into my controller, and that text isn't to be blank.

<form action="BaHumBug/Index" method="post" id="xmasTextForm">
    <input name="xmasText" type="text" id="xmasTextInput" />
</form>

Do I enforce the rule about no empty text on the client side

$('#xmasTextForm').submit(function(ev) {
{
    if ($('#xmasTextForm').val().isWhiteSpace())
    {
        alert("Fill the input with something, dude!");
        return false;
     }
}

or the server side

[HttpPost]
    public ActionResult Index (string xmasText)
    {
        if (xmasText.IsWhiteSpace())
        {
             // ....
    }

or do I do both for 2 layers of protection? Or does the choice depend on other factors?

user4905335
  • 371
  • 2
  • 13
  • Its essential to enforce server side validation. Client side validation is a nice bonus, but a malicious user can easily by pass it. You should use the features of MVC an add a `[Required]` attribute to the property and use unobtrusive client side validation to give you both server side and client side validation out of the box –  May 28 '15 at 23:48
  • Enforce rules on the client side for usability and convenience, but everything must be verified on the server. The client cannot be trusted. – Pointy May 28 '15 at 23:48

3 Answers3

2

It’s always a good practice to have at least the validation on the controller, this way you’re sure that your application is NOT receiving invalid data.

The validation on client side is also important because you can provide a good feedback for the client when this one takes your forms in a wrong way.

One thing that helps a lot on the good design of your code and controllers is apply TDD(Test driven development methodology) , if you’re familiar you can access this link to get more informed.

Through tests you can design your application by understanding and considering a good coverage of the possible input cases that you may have.

Thiago Avelino
  • 818
  • 6
  • 7
0

As has been said before - see JavaScript: client-side vs. server-side validation - there's pros for both. But I would say that it' is essential on the server.

Community
  • 1
  • 1
Mark
  • 2,926
  • 3
  • 28
  • 31
0
Its always good to have validations at client side as well as server side.

Reason being what if someone disable javascript from internet options.In that case if there are no validations at server side,your use case will fail.

You can use annotations [Required] attribute to make it mandatory field.
If JavaScript is enabled,and there is no user input in mandatory field,you will see control will not pass to controller action.

In Case JavaScript is disabled,control will pass to controller action with **ModelState.IsValid** value will be false.

Server side code should be like this:

[HttpPost]
    public ActionResult Index (string xmasText)
    {
       if (ModelState.IsValid)//rather than check of whitespace
        {
             // ....
        }
    }
Gera
  • 149
  • 4