我应该做多少验证？

Question

I have an angular client that has a form that sends requests to an api service that has the following components:

1. Form
2. Controller
3. Service

I can trigger validations on each of them but should I be doing that or applying validation on the From is sufficient?

Answer 1

In my opinion you should be validating on every layer you have listed.

Anyone can easily modify the HTML of a form to bypass any client validation, just turn of JS. So you should also be ensuring that in the controller you have the correct data.

Your service, I am assuming this might be accessible from other places/applications, so it should be enforcing the same/similar validation in the service to make sure you application is consistent with it's data.

Doing it this way will make sure no 'bad' data gets through your whole stack.

Answer 2

Forms is not sufficient, someone can disable javascript or make changes in the objects. Do atleast Forms and Service