Frontend and backend validation synergy

Question

I've created a register form validation on frontend and backend and I am checking both at the frontend and backend: whether the name and surname consist of letters only, whether the password contains numbers, uppercase and lowercase letters, whether the email is correctly saved.

The interface informs about errors. My question is, since I check all the conditions on the frontend, should the backend also send error messages to the frontend?

I mean both frontend and backend check data validation, but should the frontend react to backend error messages? It seems unnecessary for the backend to send information that f.e. the password is too short, since the frontend already does it. The backend should only make sure that f.e. the password length is appropriate.

Second question: should I check on the backend side whether the checkbox regarding acceptance of the website regulations has been selected or whether the password and the repeated password are the same?

Answer 1

First of all, if you don't want to make validation on both frontend and backend, better to leave backend validation then.

Frontend validation mostly used to:

• make UI more user-friendly and responsible
• cut requests to backend

if you are doing small pet project it might look as good idea to leave only frontend validation. But as application grows you might face a lot of issues here:

• new added logic which requires to modify data in your models (without frontend form) won't work, as you can't validate model before save.
• you will receive form on backend with invalid data (e.g. from customer with disabled/broken JS, or from someone who disabled your validation on purpose)
• you might miss some validation cases on frontend and will get inconsistent data too

So, it's must have to have backend validation. You might miss some validation on frontend (or skip it if it's not necessary, e.g. for admin panel). But missing backend validation is dead end for scalable apps.

Should I check on the backend side whether the checkbox regarding acceptance of the website regulations has been selected or whether the password and the repeated password are the same?

Yep, better to ensure your data is correct before saving data to DB.

Edit: Ah, I see, so you have backend validation. In this case, it really depends on your app. Better to show some explanation so user won't be confused. But sometimes it makes sense to just show that some error occured on server and leave it be.