0

On our web application we have a form that users can use to edit details for a particular object. In the form there is one field that requires elevated permissions to update.

On the UI, we hide that field if the user doesn't have the correct permissions to change it.

We are unsure of the best action to take during server side validation if the user attempts to by-pass the front-end validation and change the field, we could;

  • Throw an error and prevent the whole save action
  • Save the record with the rest of the changes without modifying the secure field

Is the a generally accepted best practice for this situation?

1

The users trying to bypass the client side validation are of course the people who know some code. Therefore either they are testing your app or they are trying to breach in.

Save the record with the rest of the changes without modifying the secure field

If the elements of the form are mutually exclusive + your code is stable enough to get data from unprivileged sources, then you can actually Save the record with the rest of the changes without modifying the secure field.

Throw an error and prevent the whole save action

If there is any relation between the fields that would hinder the meaning of the overall form or if there is any chance of breaching in, then I think you should not let the tech enthusiasts to play with the JS validation and still save the form.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.