Client-side Input Validation

Client-side input validation is the step where, the moment you type something into a website or app, your own computer (the browser) checks whether it looks right — before that information even leaves for the server across the internet. It's like checking, right at your front door, that a letter has a stamp on it and the address is written correctly before you drop it in the mailbox. This check is already finished inside the house, long before the letter ever reaches the post office.

Catching things this early means simple mistakes like typos can be caught instantly, without the round trip to the server. The catch is that this check runs purely off a rulebook written in advance by the code on the screen. If that rulebook itself is wrong, then even perfectly valid input keeps getting rejected. The real verdict can only come from the server, but the gatekeeper standing in front of it is holding a faulty list and blocking entry anyway.

In the article, a blogger only figured out that "the error was coming from a client-side input validation function" after opening up the source code of Google Workspace's sign-up page. When they forcibly disabled this validation function in the browser's developer tools, the sign-up went through without issue — the server hadn't actually rejected the domain at all. A list of regular expressions baked into the client-side code had simply misclassified a perfectly valid domain as belonging to an email provider and blocked it. It's easy to assume, when an error message pops up, that "the server rejected my information," but as this case shows, requests often get stopped at the screen stage without ever reaching the server.

Try entering a value that deliberately breaks the rules (like a malformed email address) into a sign-up form you use often. If the screen instantly flashes a red error the moment you type, it's likely client-side input validation catching it before it ever reaches the server. Open your browser's developer tools, temporarily disable JavaScript, and enter the same value again — often it will go through with no error this time. That difference is exactly the line between client-side validation and server-side validation.