People are still doing this?
Back in the day it wasn’t unusual to find folks using javascript for webpage security. And by “using” I mean “using it and failing miserably” since it was pretty trivial to get around.
Today I got an email pointing me to a site where I could download an album for free. Yay spiffy. But they wanted me to give em email addresses to 5 friends. That sucks
Fortunately for me, they used ajax for to check it all. So, view source, redefine their validation function in firebug to always return true, then call the function and voila, they’re thanking me for giving them the email addresses.
Couple of points here:
- It’s not free if I have to give something in exchange
- Friends don’t spam friends
- If your uses can redefine the freakin validation routines, it’s probably best not to rely on them for security.
This is why we check form inputs in javascript and on the server. Javascript makes it nicer for the user; the server check makes it safer for us.
September 2nd, 2006 at 10:59 am
I agree! The purpose of AJAX or plain JavaScript as validation is to speed things up and/or make it easier, not to completely replace server-side validations.