For input validation, which approach is safer?
Options
- Denylist: block the known bad characters only
- Allowlist: define valid input and reject the rest (Correct option)
- No validation is needed when HTTPS is enabled
- Validate only on the client side, in the browser
Answer
Allowlist: define what valid input looks like (type, length, format) and reject everything else
Why
A denylist tries to block bad things, but attackers always find variations (different encodings, new tricks).
An allowlist describes exactly what is acceptable, e.g. 'a positive integer under 1000' or 'one of: small, medium, large', and rejects everything else.
Client-side validation only improves user experience; the server must always validate (Pydantic does this in FastAPI).
Remember
Allowlist what is valid; validate on the server.