CyberCertPrepWeb App FundamentalsFront-end vs Back-endEASYFree question
An attacker uses browser DevTools to disable the 'required' attribute on a form's email field and submits the form without an email. What does this demonstrate?
- A.HTML validation attributes are a strong security control
- B.The browser has a bug that allowed this manipulation
- C.HTML attributes (required, maxlength, pattern) are only client-side convenience checks that can be trivially removed in the browser; server-side validation is the only authoritative control
- D.The server should detect that required was removed and reject the request
Why C is correct
HTML form validation (required, pattern, maxlength, type=email) runs in the browser and can be disabled or bypassed in seconds using DevTools or by sending a raw HTTP request. The back-end must always validate, sanitize, and enforce constraints on every incoming request regardless of front-end validation state.
Know someone studying for Web App Fundamentals? Send them this one.