0

I have a react.js application form that receives input. The validation is done in the client side code. Use webpack to bundle all the client side .js into a single bundle.js file. The .js is minified and obfuscated. Is it still required to do server side input validation?

Using Material UI for the form elements.

Can somebody still manipulate that client side react.js code or form elements to manipulate validation?

Andy N
  • 1,013
  • 9
  • 25
  • 3
    You *always* need server-side validation. If you think people can't use your API without your client, you're wrong. – tadman Sep 28 '22 at 03:14
  • Does this answer your question? [Is there a way to stop end-user tampering with JavaScript game code in my page?](https://stackoverflow.com/questions/22208349/is-there-a-way-to-stop-end-user-tampering-with-javascript-game-code-in-my-page) – Andy Ray Sep 28 '22 at 03:21
  • tadman, good point. Forgot about hijacking the api. – Andy N Sep 28 '22 at 14:29

1 Answers1

2

For sure you will need the server-side validation.

The data from the client to the server is passed through a Rest or GraphQL API, I can copy the request from chrome and replay it with curl, insomnia, postman or any other request tool, changing the parameters and also injecting malicious code into your application.

Please, validate any user input at the backend side too.

Gianpaulo
  • 332
  • 2
  • 7