Your form checks the email format in JavaScript before sending. Is server-side validation still needed?
Options
- No, because the browser has already checked it
- Yes: attackers can skip the browser and send requests (Correct option)
- Only for the password fields of the same form
- Only for requests that come from mobile clients
Answer
Yes: attackers can skip the browser entirely and send any request directly to the server
Why
Everything on the client can be changed by the user: they can disable JavaScript, edit the page, or send requests with curl or Postman, skipping your checks.
Client-side validation is for user experience (instant feedback). The server must validate everything again, because only the server is under your control.
Rule: never trust the client.
Remember
Never trust the client; always validate on the server.