Security · Question 4 of 12
A contact form validates its input only in the browser with the HTML attribute required and JavaScript. Why is that not enough from a security point of view?
1 answer is correct. Easy
Show answer
Answer
- B An attacker can send requests directly to the server and bypass the check in the browser
Explanation
Everything that runs in the browser is under the user's control: they can switch off JavaScript, change the HTML in the developer tools or build the request themselves with curl. Browser-side checks therefore only improve usability, because errors are shown immediately. The binding validation must always happen on the server, in TYPO3 for example with the validators of the Form Framework or with Extbase validators. required works regardless of HTTPS; the problem is not the browser, but that it must not be trusted.