The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

C O M M O N   M Y T H

It is sometimes perceived that any use of client-

side controls must be automatically bad. In particular, some professional

penetration testers report the presence of client-side controls as a “finding”

without verifying whether they are replicated on the server or whether there is

any nonsecurity explanation for their existence. In fact, despite the significant

caveats arising from the various attacks described in this chapter, there are

nevertheless ways of using client-side controls in ways that do not give rise to

any security vulnerabilities:

■■

Client-side scripts can be used to validate input as a means of

enhancing usability, avoiding the need for round-trip communication

with the server. For example, if the user enters their date of birth in an