Can jquery/javascript be modified runtime with firebug for example to mess with validators?

Question

I've a question. If I validate input fields using jquery/javascript.

Stupid example:

if (password.length > 6) { //do soemthing useful }

Can visitor fire up inspector in chrome, or firebug, and edit that value 6 to for example 2, will he be able to create password with length of 2 chars?

If yes, what is the best way to handle this? Always implement double checks on server side too?

Answer 1

Always, always validate on the server if there are ramifications* to the data being altered. This also covers the (fairly obscure these days) scenario that the user may not have JavaScript enabled.

Some frameworks (e.g. ASP.Net) make it easy to declare validation which will run first on the client but automatically be re-executed when the data reaches the server.

Remember that more than form fields are vulnerable to tampering. Cookies and URL parameters can be trivial to alter.

*^{Anything which jeopardizes the security of your data, the proper use of your application, the performance of your server(s), etc.}

Answer 2

I have to second Tim, you must always validate on the server.

A user doesn't even need complicated things like Firebug in order to bypass your validation. You are sending the JavaScript over to the user in plain text. All the user has to do is save your .html file to disk, change the JavaScript to be whatever they like, and open it in whatever browser they wish.

Even if someone doesn't do that, they can always fake whatever HTTP header (like HTTP_X_REQUESTED_WITH) if they write their own HTTP client (or use a command line HTTP client like Curl).

No debuggers, proxies, man-in-the-middles or other complicated protocol hijacking required. (Though those are all good reasons you need to validate on the server too)