If you don't use SSL then data can always be altered during transfer.
If you use SSL then there is still a very small chance for men in the middle attacks but something serious must go wrong to make them happen. For example the client must accept a fake certificate for your domain, or your SSL key must be stolen, or the CA root certificate that signed your certificate must be attacked, or the OpenSSL implementation has a bug...
So if you must validate data before it is stored in the database you should validate it on the server and not trust any client. Also keep in mind that data coming from the client could cause SQL injection on your server if you don't validate the data at all and you use it to build a DB query.
Client validation can be useful to avoid server requests though.
-- J.
You received this message because you are subscribed to the Google Groups "Google Web Toolkit" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-web-toolkit+unsubscribe@googlegroups.com.
To post to this group, send email to google-web-toolkit@googlegroups.com.
Visit this group at http://groups.google.com/group/google-web-toolkit.
For more options, visit https://groups.google.com/groups/opt_out.
No comments:
Post a Comment