Explain the concept of input validation and its importance in security

TL;DR

Input validation checks that untrusted data has the expected type, format, length, range, and business meaning. Browser validation improves feedback, but every security boundary must validate on the trusted server because clients can bypass JavaScript and submit requests directly. Prefer allowlists and explicit schemas.

Validation reduces malformed and abusive input, but it is not a universal injection defense. Continue to bind SQL parameters, encode output for its destination, sanitize intentionally allowed HTML, and enforce authorization independently.

---

Input validation and its importance in security

What is input validation?

Input validation is the process of verifying that the data provided by a user or other external sources meets the expected format, type, and constraints before it is processed by the application. This can include checking for:

• Correct data type (e.g., string, number)
• Proper format (e.g., email addresses, phone numbers)
• Acceptable value ranges (e.g., age between 0 and 120)
• Required fields being filled

Types of input validation

1. Client-side validation: This occurs in the user's browser before the data is sent to the server. It provides immediate feedback to the user and can improve the user experience. However, it should not be solely relied upon for security purposes, as it can be easily bypassed.

   <form>
     <input type="text" id="username" required pattern="[A-Za-z0-9]{5,}" />
     <input type="submit" />
   </form>

2. Server-side validation: This occurs on the server after the data has been submitted. It is essential for security because it ensures that all data is validated regardless of the client's behavior.

   const express = require('express');
   const app = express();
   
   app.post('/submit', (req, res) => {
     const username = req.body.username;
     if (!/^[A-Za-z0-9]{5,}$/.test(username)) {
       return res.status(400).send('Invalid username');
     }
     // Proceed with processing the valid input
   });

Importance of input validation in security

1. Protecting data and application assumptions: Validation rejects values the application cannot safely or meaningfully process. SQL injection is prevented primarily by parameterized queries; validation is defense in depth.

   const username = req.body.username;
   const query = 'SELECT * FROM users WHERE username = ?';
   db.query(query, [username], (err, results) => {
     // Handle results
   });

2. Reducing unsafe content: If an application intentionally accepts HTML, use a maintained HTML sanitizer with an allowlist. For ordinary text, render with a text sink such as textContent. XSS prevention still requires context-appropriate output handling because a value valid for one destination may be dangerous in another.

   const sanitizeHtml = require('sanitize-html');
   const userInput = req.body.comment;
   const sanitizedInput = sanitizeHtml(userInput);

3. Limiting resource abuse: Length and size limits can reject unexpectedly large payloads before they consume excessive CPU, memory, storage, or downstream service capacity.

4. Ensuring data integrity: Input validation helps maintain the integrity of your data by ensuring that only properly formatted and expected data is processed and stored.

Best practices for input validation

• Always validate input on the server side, even if you also validate on the client side
• Use built-in validation functions and libraries where possible
• Keep validation separate from context-specific output encoding or sanitization
• Implement allowlisting (accepting a defined shape) rather than trying to enumerate every malicious string
• Reject unexpected object properties and normalize data only when the application's comparison rules require it
• Regularly update and review your validation rules to address new security threats

Further reading

• OWASP Input Validation Cheat Sheet
• OWASP Cross Site Scripting Prevention Cheat Sheet
• MDN Web Docs: Client-side form validation
• Sanitize-html library

Exercises