验证密码确认和后端的密码是否不必要？

Question

I'm thinking if it is necessary to even ask the user to re-enter the password? Anyway if I decide to have the user re-enter the password, is comparing client side good enough and does it pose any security risks, or should I compare server side?

Answer 1

Client side is fine. The risks are the same as having a single password input field.

Answer 2

The purpose of typing the password twice is just to catch typos, it serves no security purpose. So checking it in the client should generally be sufficient. If the user disables this somehow, they're just hurting themselves, since they might submit an unintended password.

The only reason you might do it in the server as well is if you want to support users who disable JavaScript in the browser.

Answer 3

It is not for security purpose. As password input is secret (you only see ********), and the user cannot check its password, you can add a password confirmation so the user can confirm its password ie as a user I thought I wrote LOL875PASS but wrote LoL875PASS

Confirming password can bring this error to my eyes. You can pass this input by providing a "toggle" that shows password to the user