On Oct 25, 2012, at 9:20 AM, Gary McGath wrote:

> On 10/25/12 7:37 AM, Joe Hourcle wrote:
> 
>> You didn't answer the question -- why would you not have some sort of
>> check on the AJAX application (or any application, web or otherwise)
>> to do at least minimal sanity checking on the result of an external
>> call?
> 
> Because putting the onus of sanity checking on the web page isn't the
> best solution in this case. Of course, it should be set up to handle
> unexpected results sensibly in any case.

I view it like using JavaScript for form validation -- don't trust it,
and still re-do the validation in the backend.

If the costs to check tainted inputs are minimal, *do* *it*.  Even
when the back-end is well designed, there are enough other things
out there that are outside your control.

... like when IE decided to start re-writing 404 and other status
pages unless they happened to be at least 1k ... so even when we *were*
giving informative messages about what was going on, links to report
the problem, etc ... it never made it back to the user.

(and yes, I know, I've officially hit old fogey status by complaining
about changes that IE made more than 10 years ago ... I'm also not a
fan of the <br> tag ... one of the worst mistakes of HTML+)

But for more recent situations ... mobile browsers w/ spotty reception.
Man-in-the-middle attacks ... deep-packet filtering (the firewall
doesn't like some phrase used in the response, so replaces the content
with a 'blocked' message ... they may not be common, but they *do*
happen.

-Joe