Very Confused (And Worried) about security with JSON and Javascript

Question

I've been attempting to do some research on this topic for a while, and even cite the following Stack Overflow threads :

Javascript Hijacking - When and How Much Should I Worry

JSON Security Best Practices

But my basic problem is this.

When I am building my web applications, I use tools like Fiddler, Chrome Developer Tools, Firebug, etc. I change things on the fly to test things. I can even seem to use fiddler to change the data that gets sent to the server.

What stops someone else from just opening up my webpage and doing this too? All of the jQuery validation in the world is useless if a user can just hit F12 and open up Chrome Developer tools, and change the data being sent over the wire, right?

I'm still relatively new in this field and this just has me very concerned as I see "Open" Protocols become more and more ubiquitous. I don't understand SSL yet (which is on my list of things to begin researching), so perhaps that is the answer and I just haven't dug deep enough. But the level of flexibility I have over manipulating my pages seems very extreme - which has me very concerned about what someone malicious could do.

Answer 1

Your concerns are indeed justified. This is why you should always validate everything on the server. Client-side validation should only be used for UX.