Relying on client-side validation?

[Ben Fidge]

Hi

I'm interested to know what peoples opinions are on using the Client-side
Validators in ASP.NET? I use them very heavily but am experiencing the odd
occassion when users have either intentionally or inadvertantly bipassed
them.

Any ideas on how this could happen. I know that a determined hacker can push
data into http context and viewstate. But other than that, would disabling
javascript in the browser allow a user to bipass validation yet still use
the site as normal?

Thanks

Ben

[Karl Seguin]

Ben:
I rely on client-side validation heavily too, but only as a first step
measure. It's great because it's efficient for my server (no postback) and
responsive for the user (no postback).

But it's easily circumventable. By disabling javascript, by simply using
telnet, by using one of the many plugins for firefox.

You should always put a
Page.Validate()
if Page.IsValid then
...
end if

in your event handlers or wherever else you need to make sure the validation
is run on the server..

Karl

--
MY ASP.Net tutorials
http://www.openmymind.net/ - New and Improved (yes, the popup is annoying)
http://www.openmymind.net/faq.aspx - unofficial newsgroup FAQ (more to
come!)
"Ben Fidge" <be*******@btopenworld.com> wrote in message
news:ug****************@tk2msftngp13.phx.gbl...

Hi

I'm interested to know what peoples opinions are on using the Client-side
Validators in ASP.NET? I use them very heavily but am experiencing the odd
occassion when users have either intentionally or inadvertantly bipassed
them.

Any ideas on how this could happen. I know that a determined hacker can
push data into http context and viewstate. But other than that, would
disabling javascript in the browser allow a user to bipass validation yet
still use the site as normal?

Thanks

Ben

[Steve C. Orr [MVP, MCSD]]

The built-in validation controls use both client side AND server side
validation by default.
This is to cover the scenarios you mentioned.

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://SteveOrr.net
"Ben Fidge" <be*******@btopenworld.com> wrote in message
news:ug****************@tk2msftngp13.phx.gbl...

Hi

I'm interested to know what peoples opinions are on using the Client-side
Validators in ASP.NET? I use them very heavily but am experiencing the odd
occassion when users have either intentionally or inadvertantly bipassed
them.

Any ideas on how this could happen. I know that a determined hacker can
push data into http context and viewstate. But other than that, would
disabling javascript in the browser allow a user to bipass validation yet
still use the site as normal?

Thanks

Ben

[Ben Fidge]

Karl,

Thanks for the advice. If for example I use your suggestion on the Confirm
button OnClick event on a given page, what's the standard procedure for
delaing with validation errors, or does ASP.NEt handle this automatically?

Ben

"Karl Seguin" <karl REMOVE @ REMOVE openmymind REMOVEMETOO . ANDME net>
wrote in message news:OQ**************@TK2MSFTNGP09.phx.gbl...

Ben:
I rely on client-side validation heavily too, but only as a first step
measure. It's great because it's efficient for my server (no postback)
and responsive for the user (no postback).

But it's easily circumventable. By disabling javascript, by simply using
telnet, by using one of the many plugins for firefox.

You should always put a
Page.Validate()
if Page.IsValid then
...
end if

in your event handlers or wherever else you need to make sure the
validation is run on the server..

Karl

--
MY ASP.Net tutorials
http://www.openmymind.net/ - New and Improved (yes, the popup is annoying)
http://www.openmymind.net/faq.aspx - unofficial newsgroup FAQ (more to
come!)
"Ben Fidge" <be*******@btopenworld.com> wrote in message
news:ug****************@tk2msftngp13.phx.gbl...

Hi

I'm interested to know what peoples opinions are on using the Client-side
Validators in ASP.NET? I use them very heavily but am experiencing the
odd occassion when users have either intentionally or inadvertantly
bipassed them.

Any ideas on how this could happen. I know that a determined hacker can
push data into http context and viewstate. But other than that, would
disabling javascript in the browser allow a user to bipass validation yet
still use the site as normal?

Thanks

Ben

[Brock Allen]

> You should always put a

Page.Validate()
if Page.IsValid then
...
end if
in your event handlers or wherever else you need to make sure the
validation is run on the server..

You shouldn't need to explicitly call Page.Validate unless you need to check
if the page has passed validation in or prior to Page_Load. If it's only
ever needed in your server side controls' event handlers, then Page.IsValid
is sufficient.

-Brock
DevelopMentor
http://staff.develop.com/ballen

[Ben Fidge]

Hi Brock,

Thanks for that. What is standard prcoedure for IsValid = false? Does
ASP.NET automatically report to the user that there's a problem using the
client-side validators or do I have to do this manually?

Ben
"Brock Allen" <ba****@NOSPAMdevelop.com> wrote in message
news:60**********************@msnews.microsoft.com ...

You should always put a
Page.Validate()
if Page.IsValid then
...
end if
in your event handlers or wherever else you need to make sure the
validation is run on the server..

You shouldn't need to explicitly call Page.Validate unless you need to
check if the page has passed validation in or prior to Page_Load. If it's
only ever needed in your server side controls' event handlers, then
Page.IsValid is sufficient.

-Brock
DevelopMentor
http://staff.develop.com/ballen

[Brock Allen]

If the page fails to validate then the server side validation controls render
as such. At the end of the day it looks just like as if the validation was
done client-side. So, no, there's nothing special to do when you're relying
upon the server side validation. One thing to note is that if there is no
client side validation then things such as the ValidationSummary's ShowMessageBox
won't work as desired.

-Brock
DevelopMentor
http://staff.develop.com/ballen

Hi Brock,

Thanks for that. What is standard prcoedure for IsValid = false? Does
ASP.NET automatically report to the user that there's a problem using
the client-side validators or do I have to do this manually?

Ben

"Brock Allen" <ba****@NOSPAMdevelop.com> wrote in message
news:60**********************@msnews.microsoft.com ...

You should always put a
Page.Validate()
if Page.IsValid then
...
end if
in your event handlers or wherever else you need to make sure the
validation is run on the server..

You shouldn't need to explicitly call Page.Validate unless you need
to check if the page has passed validation in or prior to Page_Load.
If it's only ever needed in your server side controls' event
handlers, then Page.IsValid is sufficient.

-Brock
DevelopMentor
http://staff.develop.com/ballen