Form defense
Validate five layers without punishing the user
Client checks improve speed and comprehension. Server checks protect the boundary because every client-controlled value can be changed or omitted.
Purpose and labels
Make the requested information and reason understandable.
- User check
- Visible label, hint and required state
- Boundary check
- Accept only fields in the contract
- Failure
- Placeholder acts as the only label
Syntax
Confirm shape, type, length and encoding.
- User check
- Immediate format guidance where useful
- Boundary check
- Server allowlist and size limits
- Failure
- Client regex is treated as security
Semantics
Check whether a valid-looking value makes sense for the operation.
- User check
- Specific correction in product language
- Boundary check
- Business rule and authorization
- Failure
- Object ID format passes but belongs to another user
Submission
Handle duplicates, concurrency and slow work safely.
- User check
- Pending state and preserved input
- Boundary check
- Idempotency and transaction
- Failure
- Double click creates two records
Error recovery
Return focus, context and next action without data loss.
- User check
- Summary, field association and focus
- Boundary check
- Sanitized category and correlation
- Failure
- Form resets after one invalid field
Operating principle
Do not make the browser your security boundary
HTML constraints and client validation prevent many accidental mistakes and should be used for a better experience. They are still controlled by the requester and can be bypassed.
Parse a bounded request on the server, reject unknown or invalid fields, apply authorization and business rules, then perform side effects atomically where the product requires it.
- Use explicit labels
- Validate on the server
- Bound files and text
- Associate errors programmatically
Applied example
Failure example: valid project ID, wrong owner
A form accepts a correctly formatted project ID. The server validates its UUID shape but never checks that the signed-in user belongs to that project.
- Syntax validation passed
- Authentication was present
- Object authorization was missing
- Changing one request value crosses the account boundary
Plain answers
Questions to resolve before shipping
Should validation happen while the user types?+
Use it when feedback is stable and helpful, but avoid noisy premature errors. Always validate again on submission and on the server.
Can sanitization replace validation?+
No. Validate expected structure and meaning; use context-appropriate encoding or safe APIs for output and storage concerns.
How should file uploads be handled?+
Apply strict type, content, size, storage, authorization and malware-handling controls appropriate to the use case.