Server-side validation
Checking every price, permission and rule on the server, never trusting what a phone or browser sends, because anyone can alter those requests.
Updated October 2026 · with examples from our own builds
What does server-side validation mean in practice?
Whatever runs on a user's device can be changed. Prices on the page, amounts in a request and hidden form fields can all be edited before they reach your server. Server-side validation means the server works out the price, checks the rules and decides what is allowed from its own records.
Money is the obvious case. A confirm endpoint that accepts whatever amount the app sends invites someone to pay less, and a booking check done only in the app can simply be skipped.
Quieter rules belong here too: required fields, capacity limits and which questions a respondent actually saw. The browser checks for convenience; the server checks for real.
Server-side validation at a glance
- Never trust from the device
- Prices, amounts, roles or eligibility
- Server decides
- Price, capacity and permission from its own records
- Test with
- Requests edited by hand
Where has server-side validation come up in our builds?
Before production, a probe of the money routes found two confirm endpoints that trusted figures sent by the phone. Both now read the plan, the driver and the amount from the Razorpay order itself.
A Razorpay order is priced from the course record, never from the browser, and capacity and the enrolment window are checked again before a registration is created.
When a submission arrives, the server re-evaluates every show-if condition with the same parser the browser uses before enforcing required fields, so a visible required question can't be skipped by editing the request.
Common questions about server-side validation
If the app already checks the price, why check again on the server?
Because the request can be edited between the app and the server. The app's check is for the user's convenience; only the server's check protects your revenue.
How do I find endpoints that trust the client?
Drive every money and permission route with hand-edited requests, such as a changed amount or another user's ID, and confirm each is refused. Pakka's pre-launch probe of its money routes found two this way.
Related terms
Sources
Planning a product and not sure where server-side validation fits? Ask us, or browse all 116 terms in the glossary.