Browser and frontend
Forms: client validation helps, it does not protect
Browser checks speed users up; the real validation is repeated on the server.
Understand the concept
HTML forms give basic validation for free with attributes such as type="email", required and maxlength. JavaScript can add richer rules: two passwords matching, a date range and so on. These checks give instant feedback and avoid needless requests.
However everything on the client can be changed. Developer tools, curl or a script can bypass the form entirely and call the API directly. The same rules are therefore applied again on the server; in ASP.NET Core this is model validation, and an invalid request returns 400 before reaching the controller.
A good form experience puts the label above the field and the error below it, keeps what the user typed when there is an error, and shows field-level errors from the server next to the right field. Disabling the button while submitting prevents double submissions.
Two-layer validation gives both a good experience and safe data.
Validating only on the client and letting the server trust incoming data.
One topic. Three levels of depth.
<label for="email">E-posta</label>
<input id="email" name="email" type="email" required autocomplete="email">The browser catches an invalid e-mail before submission.
This page connects to no real server or database. Code samples are illustrative for .NET 8, Next.js and SQL Server; timings are example values in the simulation, not measurements. Try samples only in your own development environment; never share real connection strings, tokens or passwords.
Try it yourself first.
The message field is limited to 2000 characters on the client. An attacker sends a 5 MB message. Which layers must stop it?
Show the solution and explanation
1) İstek boyutu sınırı (ör. [RequestSizeLimit] veya Kestrel MaxRequestBodySize)
2) Model doğrulaması: [MaxLength(2000)]
3) Veritabanı kolon sınırı: nvarchar(2000)Defence is layered: oversized bodies are rejected before being read, the rest is validated, and the database enforces the final limit.