1
  1. My server send some data to the mobile app
  2. The user does some operations with those data and sends other objects back to the server, which contains the data that the server first sent (PS: of course those objects are created by the mobile app through user interaction)

Before the server persist mobile's data, should I validate if the server data inside it is consistent? Because if it's not, it will cause a exception.

But if you know it will cause a exception, why don't you avoid it?

Because I'm relying on:

  1. Mobile app to be working 100% and send consistent data
  2. Authentication between requests so it's not forged
  3. Extra overhead checking something that normally would be OK, unless someone hacks it
Edson Horacio Junior
  • 3,033
  • 2
  • 29
  • 50

1 Answers1

0

Yes, you should validate and sanitize all inputs on the server side. Authentication doesn't help with integrity. If I am an attacker, I can make HTTP requests using CURL bypassing any security control you may have in your app.

gauravphoenix
  • 2,814
  • 3
  • 25
  • 33