Search code examples
javascriptvalidationemailclient-sideserver-side

Server side validation when using JavaScript to send an email?


On my site I use Angular and the $http object to send an email. It's just a simple contact form. I validate the email and make sure the required fields have been filled with a simple regular expression.

Even with server-side languages, there's still not really away to validate emails as far as I know. (See this question.) The most I could really do is apply the same basic regex.

Since I'm sending the email with a client side script (I don't even support people who have JS disabled anymore. A good discussion here on that.) and the email will not send unless the user has JavaScript enabled, is there really any need to validate on the server-side?

Is there a general rule of thumb for when you need to use server-side validation?


Solution

  • Since I'm sending the email with a client side script … is there really any need to validate on the server-side?

    You have no control over what people send in HTTP requests to your server.

    While they can't simply submit a form to get the expected result (which is a shame, since JS can fail for many reasons other than simply being disabled on the client), they can still read your code and/or use their browser tools to determine the API of your webservice. Given that information, it is trivial to build a client to send whatever data (including malicious data) they like to it.

    Is there a general rule of thumb for when you need to use server-side validation?

    Yes. You always need server-side validation. Client-side validation is there only as a convenience (faster / better UI) for the visitor.