The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

incorrect format, alerting them to the problem via a client-side script

provides a much more seamless experience. Of course, the application

must revalidate the item submitted when it arrives at the server.

■■

There are occasional cases where client-side data validation can be

effective as a security measure — for example, as a defense against

DOM-based cross-site scripting attacks. However, these are cases

where the direct focus of the attack is another application user, rather

than the server-side application, and exploiting a potential

vulnerability does not necessarily depend upon transmitting any

malicious data to the server. See Chapter 12 for further details of this

kind of scenario.

■■

As described previously, there are ways of transmitting encrypted data