# Example 686 — The value was validated on the client and trusted on the server `the_value_was_validated_on_the_client_and_trusted_on_the_server.eml` - The client checks every field before submitting and catches twenty-six thousand bad inputs a day. How many submissions reach the server unchecked is computed below. ## EML ```eml # Self-authored for the EML case corpus (no external origin). The client checks # every field before submitting and catches twenty-six thousand bad inputs a # day. How many submissions reach the server unchecked is computed below. # # The client-side validation is thorough and it is not security theatre — it is # there for the user. Every field is checked as it is typed, the message says # what is wrong rather than that something is, and it turns twenty-six thousand # would-be round trips a day into an immediate correction. Removing it would # make the product worse. # # It runs where the user is. Server-side validation covers fourteen of fifteen # fields; the fifteenth was left out during a deadline with the note that the # form already checks it, which was true and is a statement about one caller. # # A hundred and twelve thousand submissions a day do not come from the form. 840000 => submissions_per_day 26400 => caught_by_the_client_per_day 15 => fields 14 => fields_checked_on_the_server 112000 => submissions_not_from_the_form fields - fields_checked_on_the_server => fields_trusted_from_the_client submissions_per_day - submissions_not_from_the_form => submissions_from_the_form "submissions per day : " + str(submissions_per_day) ^0 " from the form : " + str(submissions_from_the_form) ^0 " from an integration : " + str(submissions_not_from_the_form) ^0 "caught by the client daily : " + str(caught_by_the_client_per_day) ^0 "" ^0 "fields : " + str(fields) ^0 " checked on the server : " + str(fields_checked_on_the_server) ^0 " trusted from the client : " + str(fields_trusted_from_the_client) ^0 "" ^0 # ---- what the client validation does ---- "the form" ^0 " checks every field as it is typed : yes" ^0 " message names what is wrong : yes" ^0 " round trips saved per day : " + str(caught_by_the_client_per_day) ^0 " is it security theatre : no, it is for the user" ^0 " verdict : GOOD VALIDATION" ^0 "" ^0 " removing it would make the product worse and nobody" ^0 " should" ^0 "" ^0 # ---- what it is evidence about ---- "the scope of a client-side check" ^0 " submissions it inspects : the ones it produced" ^0 " submissions it inspects that it did not produce : none," ^0 " because it is not on that path" ^0 " what the note said : the form already checks it" ^0 " what the note meant : the form's submissions are checked" ^0 "" ^0 " the sentence is true; the inference drawn from it names" ^0 " a population one caller does not cover" ^0 "" ^0 int(submissions_not_from_the_form * 10000 / submissions_per_day) => unvalidated_per_myriad "share arriving with that field unchecked : " + str(unvalidated_per_myriad) + " per ten thousand" ^0 "" ^0 # ---- why the integrations exist ---- # They are documented, supported, and were the reason the API was built. Nobody # bypassed anything; the form is one client among several and it is the only # one the note considered. "the callers" ^0 " the form : one client" ^0 " documented integrations : several, supported, intended" ^0 " anyone bypassing a control : nobody" ^0 " clients the note considered : one" ^0 "" ^0 # ---- null control ---- # The same client validation, with the fifteenth field checked on the server # as well. 0 => nc_submissions_with_an_unchecked_field caught_by_the_client_per_day => nc_caught_by_the_client "null control - the fifteenth field checked on the server too" ^0 " caught by the client : " + str(nc_caught_by_the_client) + ", unchanged" ^0 " submissions with an unchecked field : " + str(nc_submissions_with_an_unchecked_field) ^0 " the form did not change; the check moved to the place" ^0 " every caller passes through" ^0 "" ^0 # ---- the rule ---- "what client-side validation guarantees" ^0 " this client sends well-formed values : exactly" ^0 " the server receives well-formed values : not addressed;" ^0 " it is a property of one caller, and the server's" ^0 " population is every caller" ^0 "" ^0 "a check is evidence about the traffic that passes through it;" ^0 "moving one to the client improves the experience of that" ^0 "client and removes it from the boundary" ^0 "" ^0 "The form checks every field as it is typed and saves " + str(caught_by_the_client_per_day) + " round trips a day," ^0 "which is real and worth keeping. " + str(fields_checked_on_the_server) + " of " + str(fields) + " fields are also checked on the" ^0 "server; the fifteenth was left to the form, so the " + str(submissions_not_from_the_form) + " submissions a day" ^0 "that arrive from documented integrations - " + str(unvalidated_per_myriad) + " per ten thousand - carry that" ^0 "field unchecked, and nobody bypassed anything." ^0 ``` ## Python (deterministic transpilation) ```python submissions_per_day = 840000 caught_by_the_client_per_day = 26400 fields = 15 fields_checked_on_the_server = 14 submissions_not_from_the_form = 112000 fields_trusted_from_the_client = fields - fields_checked_on_the_server submissions_from_the_form = submissions_per_day - submissions_not_from_the_form print("submissions per day : " + str(submissions_per_day)) print(" from the form : " + str(submissions_from_the_form)) print(" from an integration : " + str(submissions_not_from_the_form)) print("caught by the client daily : " + str(caught_by_the_client_per_day)) print("") print("fields : " + str(fields)) print(" checked on the server : " + str(fields_checked_on_the_server)) print(" trusted from the client : " + str(fields_trusted_from_the_client)) print("") print("the form") print(" checks every field as it is typed : yes") print(" message names what is wrong : yes") print(" round trips saved per day : " + str(caught_by_the_client_per_day)) print(" is it security theatre : no, it is for the user") print(" verdict : GOOD VALIDATION") print("") print(" removing it would make the product worse and nobody") print(" should") print("") print("the scope of a client-side check") print(" submissions it inspects : the ones it produced") print(" submissions it inspects that it did not produce : none,") print(" because it is not on that path") print(" what the note said : the form already checks it") print(" what the note meant : the form's submissions are checked") print("") print(" the sentence is true; the inference drawn from it names") print(" a population one caller does not cover") print("") unvalidated_per_myriad = int(submissions_not_from_the_form * 10000 / submissions_per_day) print("share arriving with that field unchecked : " + str(unvalidated_per_myriad) + " per ten thousand") print("") print("the callers") print(" the form : one client") print(" documented integrations : several, supported, intended") print(" anyone bypassing a control : nobody") print(" clients the note considered : one") print("") nc_submissions_with_an_unchecked_field = 0 nc_caught_by_the_client = caught_by_the_client_per_day print("null control - the fifteenth field checked on the server too") print(" caught by the client : " + str(nc_caught_by_the_client) + ", unchanged") print(" submissions with an unchecked field : " + str(nc_submissions_with_an_unchecked_field)) print(" the form did not change; the check moved to the place") print(" every caller passes through") print("") print("what client-side validation guarantees") print(" this client sends well-formed values : exactly") print(" the server receives well-formed values : not addressed;") print(" it is a property of one caller, and the server's") print(" population is every caller") print("") print("a check is evidence about the traffic that passes through it;") print("moving one to the client improves the experience of that") print("client and removes it from the boundary") print("") print("The form checks every field as it is typed and saves " + str(caught_by_the_client_per_day) + " round trips a day,") print("which is real and worth keeping. " + str(fields_checked_on_the_server) + " of " + str(fields) + " fields are also checked on the") print("server; the fifteenth was left to the form, so the " + str(submissions_not_from_the_form) + " submissions a day") print("that arrive from documented integrations - " + str(unvalidated_per_myriad) + " per ten thousand - carry that") print("field unchecked, and nobody bypassed anything.") ``` ## stdout (executed) ```text submissions per day : 840000 from the form : 728000 from an integration : 112000 caught by the client daily : 26400 fields : 15 checked on the server : 14 trusted from the client : 1 the form checks every field as it is typed : yes message names what is wrong : yes round trips saved per day : 26400 is it security theatre : no, it is for the user verdict : GOOD VALIDATION removing it would make the product worse and nobody should the scope of a client-side check submissions it inspects : the ones it produced submissions it inspects that it did not produce : none, because it is not on that path what the note said : the form already checks it what the note meant : the form's submissions are checked the sentence is true; the inference drawn from it names a population one caller does not cover share arriving with that field unchecked : 1333 per ten thousand the callers the form : one client documented integrations : several, supported, intended anyone bypassing a control : nobody clients the note considered : one null control - the fifteenth field checked on the server too caught by the client : 26400, unchanged submissions with an unchecked field : 0 the form did not change; the check moved to the place every caller passes through what client-side validation guarantees this client sends well-formed values : exactly the server receives well-formed values : not addressed; it is a property of one caller, and the server's population is every caller a check is evidence about the traffic that passes through it; moving one to the client improves the experience of that client and removes it from the boundary The form checks every field as it is typed and saves 26400 round trips a day, which is real and worth keeping. 14 of 15 fields are also checked on the server; the fifteenth was left to the form, so the 112000 submissions a day that arrive from documented integrations - 1333 per ten thousand - carry that field unchecked, and nobody bypassed anything. ``` ## Round-trip `ok: true` — round-trip fixpoint reached (python1 == python2) ## Trace event types eml:run:start · eml:assign · eml:output · eml:run:done