Is validating password confirmation and the password in the backend unnecessary?

Question

I'm thinking if it is necessary to even ask the user to re-enter the password? Anyway if I decide to have the user re-enter the password, is comparing client side good enough and does it pose any security risks, or should I compare server side?

Answer 1

The purpose of typing the password twice is just to catch typos, it serves no security purpose. So checking it in the client should generally be sufficient. If the user disables this somehow, they're just hurting themselves, since they might submit an unintended password.

The only reason you might do it in the server as well is if you want to support users who disable JavaScript in the browser.