ValidateInputServerSide [rule] v0.1.0

Every value that enters trust boundaries — request body, query string, headers, cookies, file uploads, message-queue payloads — must be validated server-side before it influences a decision, query, or write. Client-side validation is a UX feature, not a security control.

Checks

• Validation runs in the server process before the value reaches business logic, persistence, or downstream services.
• Validation uses an allow-list (positive model): expected type, length, range, character set, format. Reject anything not explicitly allowed.
• Validation runs even when client-side checks already passed; never trust the client to have run them.
• Validation rejects with a 4xx and a generic message; do not echo the offending value back unescaped.

Label

All input must be validated on the server

ValidateInputServerSide [rule] v0.1.0

Every value that enters trust boundaries — request body, query string, headers, cookies, file uploads, message-queue payloads — must be validated server-side before it influences a decision, query, or write. Client-side validation is a UX feature, not a security control.

Checks

• Validation runs in the server process before the value reaches business logic, persistence, or downstream services.
• Validation uses an allow-list (positive model): expected type, length, range, character set, format. Reject anything not explicitly allowed.
• Validation runs even when client-side checks already passed; never trust the client to have run them.
• Validation rejects with a 4xx and a generic message; do not echo the offending value back unescaped.

Label

All input must be validated on the server

Label

All input must be validated on the server