需要JavaScript时，服务器端验证失败时不显示错误可以吗？
我们有一个绝对需要 JavaScript 才能运行的表单，并且验证是在客户端完成的。验证也在服务器端执行，但是当服务器端验证失败时让它显示错误将是一项巨大的工作量。
既然用户不可能没有 JavaScript，那么仅仅因为 HTTP 错误而失败可以吗？他们无法通过服务器端验证的唯一原因是他们要么是恶意用户，要么无法使用 JavaScript，在这种情况下他们无论如何也不会使用该表单。
谢谢
We have a form that absolutely requires JavaScript to function, and validation is done client side. Validation is also performed server side, but it would be an extreme amount of work to get it to show errors when server side verification fails.
Since there is no chance for the user to not have JavaScript, is it OK to just fail with an HTTP error? The only way they would fail server side verification was if they either are a malicious user, or can't use JavaScript, in which case they wouldn't be using the form anyway.
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
我说这很好，除了某类错误。
某些验证错误并非出于恶意，只是在实际处理表单之外的任何其他时间都无法检查和发现。这可能是因为需要保留但无法保留的稀缺资源（“此用户名已在使用中”），或者是由于某些服务器端可恢复错误（“上游信用卡处理器没有响应。请重试”）之后”）。对于这些类型的错误，您绝对应该将某种错误消息传达给用户。很难想象有一种设计不可能将此类错误发回。至少您可以这样做：
然而，最重要的是进行服务器端验证而不是信任客户端。您已经在这样做了，因此如果您想进一步做任何事情，那就需要进行完善并尽可能提供最佳的用户体验。有时这需要付出不成比例的努力，但这没关系。
I say this is fine, except for a certain class of errors.
Some validation errors are not a result of malice but simply cannot be checked and discovered at any other time than when the form is actually processed. This can be because of a scarce resource that needs to be reserved but cannot be ("this username is already in use"), or because of some server-side recoverable error ("The upstream Credit Card processor is not responding. Please try again later"). For these kinds of errors, you absolutely should have some kind of error message communicated back to the user. It's hard to envision a design where sending these kinds of errors back would not be possible. At the very least you can do this:
The most important thing, however, is to have server-side validation and not trust the client. You are already doing this, so if you want to do anything further it is a matter of polish and making for the best possible user experience. Sometimes that requires a disproportionate amount of effort and that's ok.
我个人觉得还好。
特别是如果使用该网站的前一步在没有 Javascript 的情况下也根本无法工作，因此用户在没有 Javascript 的情况下无法进入相关页面，那么在没有 Javascript 的情况下使其工作的巨额费用就是浪费精力。例如，在 .Net Web 表单中，登录需要 Javascript，因此在我看来，网站安全区域内的任何页面都可以假设 Javascript 可用。
不过，我很好奇其他人的想法。
I personally think it is fine.
Especially if a previous step in using the site would also not work at all without Javascript, so the user couldn't have proceeded to the page in question without Javascript, then going to the huge expense of making it work without Javascript is wasted effort. For example, in .Net webforms, logging in requires Javascript, so any pages inside the secured area of the site can, to my mind, assume Javascript is available.
I'm curious what other people think, though.
如果 http 请求失败的唯一预期用例是有人绕过浏览器，那么仅仅使 http 请求失败似乎就完全没问题了。您不会影响任何预期的用户场景，但仍然通过服务器端验证来保护服务器端完整性。做更多的工作是没有意义的。对我来说似乎不错。
如果存在实际的合法用户场景，其中错误数据会传输到服务器，那么值得做更多工作来显示来自服务器的错误 UI。但是，既然您认为合理的场景不太可能或不可能发生，那么就没有理由做额外的工作。
If the only expected use case for failing the http request is when someone has bypassed the browser, then just failing the http request seems perfectly fine. You aren't impacting any expected user scenario, yet you are still protecting the server-side integrity with server-side validation. There's no point in doing more work than that. Seems fine to me.
What would make it worth it to do more work to show error UI from the server would be if there are actual legitimate user scenarios where bad data would get through to the server. But, since you think that is unlikely or impossible for a legitimate scenario to go there, then there's no reason do do that extra work.
只要您确定客户端验证和服务器端验证是等效的就可以了。在这一点上，我发现保持客户端验证代码和服务器端验证代码同步很麻烦（特别是如果它们是用不同语言编写的，如果您不使用node.js或GWt，情况总是如此） ）。如果有人有任何解决方案那就太好了。
但是，如果某些验证只能在服务器端执行（例如数据库唯一性约束），那么向用户显示其客户端操作已失败就很重要。但这取决于应用程序本身。
It is ok so long as you are certain that the client side validation and server-side validation are equivalent. On that note, I find it hassle some to keep the client-side validation code and server-side validation code in sync (Especially if they are written in different languages, which is always the case if you are not using node.js or GWt). If anyone has any solution that it would be great.
However, if there are certain validation that can only be performed on server-side (database uniqueness constraint, for instance), then it is important to show user that their client-side actions have failed. That depends on the application itself though.