jQuery validation for ASP.NET, security issues

I would like to replace asp.net form validation with jQuery validation but not sure is this secure. ASP.NET validation use client side and server side validation to prevent hack post to server by disabling client side JS validation. If I will use client side jQuery validation then it can be easily compromised, no? Maybe I am missin开发者_如何学Gog something?

---

You should not use ONLY client side validation. It can be easily avoided. People generally use client side validation for the User Experience. That way forms don't have to do a full post to catch mistakes. You want to do server side validation for security purposes.

---

jQuery validation is exactly the same as client side JS validation. jQuery is javascript framework.

ALWAYS use server side validation, and if you want to improve the user's experience then include your client side validation.

---

you should always write server-side validation code even if you validate the data on the client, otherwise your site will be unsafe and easily could be hacked. But the reason for writing client-side validation is to avoid the round-trip to the server that would otherwise be required to validate the data. In other words, if the user enters invalid data, it's much more efficient and user-friendly to trap the error before sending the data to the server, where if the data is invalid you'll have to rebuild the page and maintain the page state as well so that the user can fix the invalid value.

---

Try using asp.net AJAX plus server control validators as your validation framework for the following reasons:

1. It's secure because your validation runs in the server side
2. It's easier to implement because you dont have to write the same code twice, both in the server and in the client (javascript)
3. Server side code it's by far much easier to maintain than client side code
4. Your website will look responsive, although you must take care on how to reduce the data traveling in every partial postback. Research on this.
5. You are tied to the asp.net sintax and your developers will love this too. You won't actually need more.

Recommendations:

• focus is lost on every partial postback: the DOM portion of the form submitted inside the update panel is replaced, and the browser does nothing to set the focus for the user. So make sure to set the focus on the proper controls thinking the user is entering data using the TAB keystroke.
• if you want to customize the appeareance of your server validator controls with css, try inheriting the main validators: Custom, Regex and requiredField, with your own classes, which basically set and unset the error css class and message you want every server roundtrip (set before rendering). then map those custom classes to the framework's classes in the web.config (use tagmapping), so you alway use the default markup for server side validations. You get this way the best of the two worlds.

---

Jquery.validate.js

https://github.com/jzaefferer/jquery-validation

You can set this up to run independently of your own client side validation/instead of/or in conjunction with.