0

We have an intake form built using Aura Components and its a simple form. The submit button on the aura component is enabled or disabled depending on what time it is. Basically, they are not allowed to submit the form past 4:00pm EST.

However, the user can mischievously change their computer's clock to before the deadline (e.g. 2pm EST), allowing to 'hack' or bypass the 4:00pm EST deadline. And by doing so they are able to "trick" the system and submit the form even though it's way past the deadline.

Obviously, Salesforce's Server Time would probably catch this, but we probably don't want to poll the salesforce server to get the server's current time (or maybe we do?) What is the best practice in this situation? Any insights or guidance would be great.

Improve this question

1 Answer 1

Reset to default
2

As OWASP says:

Be aware that any JavaScript input validation performed on the client can be bypassed by an attacker that disables JavaScript or uses a Web Proxy. Ensure that any input validation performed on the client is also performed on the server.

It's okay to have client side validation, but you must also check on the server to prevent savvy users from bypassing your logic.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .