1

I am currently using client-side HTML validation for all my forms. This includes things like Quantity must be a positive integer and Price must be non-zero. I have enforced this on the client-side, and am also doing it on the server side. But now I am wondering whether it is worth the effort of adding error messages to each field of the form, or just return a HTTP 400 Bad Request/HTTP 422 Unprocessable Entity.

Is it alright to treat any data that has snuck past client-side validation as malicious, or are there situations where a client might input bad data that will unintentionally pass the client-side validations?
(Note: I am not using any javascript, just the HTML pattern, min, max attributes in input tags.)

Edit / TL; DR

The client-side validation shows pretty error messages when it fails. Should the server-side validation do the same, or return a generic HTTP error page?

vikarjramun
  • 1,042
  • 12
  • 30
  • I would always use validation both front and back personally - but this question is too broad. – StudioTime Apr 28 '18 at 18:32
  • @DarrenSweeney I am using validation on both ends. The client-side validation shows pretty error messages to the user. I am wondering if the server side validation should also show pretty error messages or a generic HTTP error page. I will edit the question to show this. – vikarjramun Apr 28 '18 at 18:39

1 Answers1

1

Only if the browser does not support the validation attribute you use. According to caniuse, the pattern attribute is currently supported in all current desktop browers, but not all mobile browsers.

That is, if you are targeting current desktop browsers, server side errors will only be shown to malicious users, and there is no reason to go out of your way to give helpful error messages. On the other hand, if you are in a mobile market, you might want to add helpful error messages for the poor souls using less capable browsers.

meriton
  • 68,356
  • 14
  • 108
  • 175
  • Perfect, thanks! This is just a pet project of mine (a proof-of-concept), and the design is already horrible on mobile, so I will just stick to server side errors. – vikarjramun Apr 28 '18 at 19:08