Web Security · Junior · Question 2 of 75
A form checks in JavaScript that the age field is a number from 18 to 120. Is that enough to protect the server?
- 1Yes: the browser won't let anyone submit the form with a wrong value
- 2Yes, as long as the validation code is minified
- ✓Correct answer: No: an attacker can skip the page and send any request directly, so the server must validate too
Explanation
Client-side validation is for user experience. Anyone can send a request with curl or DevTools, so every rule that matters must be checked again on the server.