Minus three tickets
A customer bought minus three concert tickets. Your app 'charged' them -$60 and added $60 of store credit to their wallet.
This answers: Is form validation enough to secure my API? No coding needed. 3 quick decisions.
- Payments and webhooks
- Where your data lives
Checking your access…
Is form validation enough to secure my API?
No. Form rules like required, min and max run in the browser for the honest user's convenience, but anyone can send the request directly with any values. Validate every field on the server, checking type, range, length and allowed values with a schema library like Zod, and add database constraints as a last line of defence.
Breaks at Your server: Quantity never checked on the server
Why AI tools write this bug
AI tools put validation where it is visible, in the form, and often generate that read the body without checking it.
How to fix it
- List every field each accepts.
3 more steps, and a prompt that checks your own app for this bug. Part of Pro.
UnlockCommon questions
- Should I remove validation from the form then?
- No. Keep it for a friendly experience, and repeat it on the server for safety. Only the server's check protects you.