Server-side Userinput Validation

Question

We work with SAP-Fiori / SAPUI5 / OpenUI5. Those frameworks are based on JS only. Due to manipulation issues on JS, we must not validate user inputs only via JS / through frontend. So a dev gave me the advice to verify and validate User Inputs (through form eg) via Stored Procedures.

Is this a good practice? Thanks for any help!

Answer 1

There are checks which can be performed in the frontend and there are checks which can be performed in the backend.

frontend: You can do basic input validation, like zip count, if value is not langer than x digts. Or you can check that it is of the right type. You can filter out bad characters and so on.

backend: this is where you can check the pre-checked inputs against some data from backend systems, eg if the id of the user exists, authorization and so on.

So you can still do some frontend checks for basic input and security related things in the backend.