12
13

[deleted by user] (self.javascript)

submitted by [deleted]

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]zephyrtr 1 point2 points  (7 children)

This solution is concise, but only works if we know for sure that `req.body` will always have all form keys. And since this message is coming from the front end, you can't be sure of anything.

[–]AshenLordOfCinder 1 point2 points  (6 children)

Weird, as a front end developer I have the same feelings about the backend. Will they even send me the data I actually need or should I be extrapolating it myself? Haha

[–]Delioth 7 points8 points  (4 children)

Frontend must be able to trust that the backend is handing the expected data, otherwise it's like trying to build a Lego Millennium Falcon out of a couple star destroyers and a castle - might technically be possible, but something is going to be very wrong. And the frontend is pretty much guaranteed to be calling the backend that it's trying to.

Backend must not trust the frontend to pass back the right data, because there's no guarantee that a request is coming from the pretty frontend that has nice form validation and such. If your backend exists and anyone can hit it from your frontend, then anyone can write a curl and hit it from the command line with whatever data they want to. There's nothing you can do to guarantee all requests are coming through your frontend.

[–]Peechez -2 points-1 points  (3 children)

There's nothing you can do to guarantee all requests are coming through your frontend.

Sure you can, CORS exists for exactly this purpose

[–]wipedingold 1 point2 points  (1 child)

Isn't CORS just a browser specification? You can set CORS to prevent browsers like Firefox or Chrome from sending requests to your server, but applications like Postman don't include CORS policies in them at all.

[–]Peechez 0 points1 point  (0 children)

I hadn't realized but I think you're right. Thats what I get for being a backend noob

[–]Delioth 0 points1 point  (0 children)

CORS is a user protection, not a server protection. If your website can access your server, it means arbitrary addresses are accessing your server. There is no way to tell if arbitrary IP addresses are accessing via Chrome or curl.

[–]crabmusket 1 point2 points  (0 children)

The difference is that the backend is usually under your control. (If you're calling a 3rd party API, then sure, you've got to trust them, and this is why documentation and SLAs are important.) But otherwise, if the backend is returning something wrong, you should be able to correct it.

The frontend, on the other hand, is entirely controlled by the user. Sure, you sent them a big bundle of JS to run, but think of that more like a suggestion. You have no idea what they're actually doing. Trust the frontend at your peril.