Browser validation alone does not stop hackers

A web form appears on a screen with a required field for an email address. If the user leaves it blank or forgets the @ symbol, a red warning message pops up instantly. The browser prevents the form from being sent until the mistake is fixed. This process is known as client-side validation. It happens entirely within the browser, which is the software used to view websites.

For many years, this felt like a complete security solution. In the early days of the internet, network connections were slow. Sending data to a server and waiting for a response just to find out a box was empty felt wasteful. Performing checks locally on the user’s machine saved time and reduced the load on the server. It stopped honest mistakes before they ever left the computer. It seemed logical to stop bad data at the gate rather than letting it travel across the world only to be rejected.

The illusion of control#

The problem is that the browser lives on the user’s computer. The person using the site owns the hardware and controls the software. A malicious actor can simply tell the browser to ignore the rules. One might disable JavaScript, which is the programming language browsers use to run these checks. With a flick of a switch in the settings, the red warning messages vanish.

A more determined attacker will not even bother with the browser interface. They may use a proxy, a piece of software that sits between the browser and the server to intercept data. The user fills out the form correctly to satisfy the browser. Once the request is sent, the proxy catches it in mid-air. The attacker then changes the data to something harmful before forwarding it to the server. To the server, the request looks like it has already passed all the necessary tests. It arrives as a polite package containing a hidden bomb.

Moving the line of defence#

As attacks became more sophisticated, security experts recognised that trusting the client was a fundamental flaw. The Open Web Application Security Project, or OWASP, helped formalise this understanding. This organisation identifies the most critical security threats to web applications to help developers build better defences. One of its core principles is that any data coming from a user must be treated as untrusted.

The only validation that provides real security happens on the server. This is called server-side validation. When a request arrives at the data centre, the server must analyse every piece of information independently. It should not assume the browser has already checked the data. Instead, it must recognise whether the input fits the required format and length before allowing it to touch a database or a file system.

Browser checks are still valuable, but their purpose has changed. They are now seen as a courtesy to the user. They provide immediate feedback and prevent a person from wasting time on a typo. They improve the user experience by making the interface feel snappy and helpful. However, they are not a security feature. Relying on them for security is like locking a front door but leaving the key in the lock for any passer-by to find.

Move all critical validation logic to the server. Ensure every input field is checked for type, length, and content before it is processed or stored. Treat browser-level checks as a way to improve the user experience rather than a method of defence.