Serguey Asael Shinder – IT Professional

Early on, I thought validation was validation.

I checked the form in the browser.
Required fields, sane values, a tidy little
“please enter a valid amount.”
It looked airtight.

Then someone showed me
how little that meant.

They opened the tools,
changed a value the page had “locked,”
and sent it straight to my server —
which happily accepted it,
because my server had assumed
the browser was telling the truth.

It wasn’t. It never had to.

That was the day I understood
something I should have known from the start:
the client is not on my side.
Not because my users are malicious,
but because I don’t control
what runs on their machine.

Anything I enforce in the browser
is a suggestion.
The dropdown can send a fourth option.
The required field can arrive empty.
The price I set in JavaScript
can come back as a penny.

Now I check on the client to be kind —
fast feedback, fewer mistakes for honest people.

And I check again on the server
to be safe,
because that’s the only place
I actually hold the keys.

I treat every incoming request
like a stranger wrote it.

Often enough,
a stranger did.

– Serguey Asael Shinder