<h2 id="808eb961-aab7-4f9a-8df0-639d0656607a" data-toc-id="808eb961-aab7-4f9a-8df0-639d0656607a">Introduction to Data Validation</h2><p>Validation ensures data meets expected formats and requirements. Invalid requests are typically rejected, and an error is returned to users. There are multiple validation points, but this guide focuses on <strong>Client-Side and Server-Side validation</strong>.</p><ul><li><p><strong>Client-Side data validation</strong>: Implemented using JavaScript to check data in the user's browser before sending it to the server.</p></li><li><p><strong>Server-Side data validation</strong>: Added as an extra step in the business flow to validate data type and content before processing.</p></li></ul><p>Salesforce Commerce Cloud recommends performing <strong>light Client-Side validation</strong> to improve user experience but always enforcing <strong>thorough Server-Side validation</strong>, duplicating all client-side checks.</p><p></p><h2 id="33b8c7a9-106f-4f38-bb01-8ac138441dd4" data-toc-id="33b8c7a9-106f-4f38-bb01-8ac138441dd4"><strong>Unlock SFCC Pro Tips!</strong></h2><p><span style="color: rgb(16, 24, 40)">Imagine what you’re missing in our other guides! Stay ahead of the competition, get exclusive pro tips, and master Salesforce Commerce Cloud like never before.</span></p><p>👉 <a target="" rel="noopener noreferrer" href="https://www.sfcclearning.com/subscribe"><strong><u>Subscribe NOW and never struggle with SFCC again!</u></strong></a></p><p></p><h2 id="946fe24a-72f5-4fe6-9b1d-80931e7f7cee" data-toc-id="946fe24a-72f5-4fe6-9b1d-80931e7f7cee">Threats</h2><ul><li><p>Helps prevent injection attacks, such as <strong>Cross-Site Scripting (XSS)</strong>.</p></li></ul><p></p><h2 id="87c16817-e9dc-48fa-a5fc-977ac01a59c6" data-toc-id="87c16817-e9dc-48fa-a5fc-977ac01a59c6">Why is Data Validation Important?</h2><p><strong>Validation ensures that bad or malicious data never enters an application.</strong><br>Duplicating Client-Side checks on the Server prevents attackers from bypassing the front-end and sending manipulated data.</p><p></p><h2 id="f1bacb97-2fe8-470c-9060-5bf68f01997c" data-toc-id="f1bacb97-2fe8-470c-9060-5bf68f01997c">How Does Data Validation Protect SFCC from Threats?</h2><ul><li><p>Client-Side validation provides immediate feedback to users for minor input errors.</p></li><li><p>Server-Side validation ensures malicious users cannot send direct requests with altered data.</p></li></ul><p></p><h2 id="0bb87094-632e-4dee-a331-8742fa009f9b" data-toc-id="0bb87094-632e-4dee-a331-8742fa009f9b">Common Issues in Data Validation</h2><h3 id="f36a21aa-2ed3-4170-8cfc-5807c35554b6" data-toc-id="f36a21aa-2ed3-4170-8cfc-5807c35554b6">Client-Only Checking</h3><p>Disabling a button in the front-end <strong>does not prevent an attacker</strong> from modifying the form via browser developer tools and submitting invalid data.</p><pre><code class="language-html">&lt;!-- authorized_purchase.isml --&gt;
&lt;form action="${URLUtils.httpsContinue()}"&gt;
    &lt;input type="submit" value="Submit My Purchase" disabled="disabled"/&gt;
&lt;/form&gt;</code></pre><pre><code class="language-js">// SubmitPurchase.js
if(parameters.submit_purchase != null &amp;&amp; parameters.submit_purchase.length &gt; 0) { 
    submitpurchase();
}</code></pre><p></p><h3 id="6f75ad4a-418e-40a7-9663-c63f82767f4d" data-toc-id="6f75ad4a-418e-40a7-9663-c63f82767f4d">Exposing Internal Data</h3><p>Validating data in the front-end may expose sensitive internal logic, such as valid promo codes.</p><pre><code class="language-html">&lt;!-- flashsalecodes.isml --&gt;
&lt;form name="myForm" onsubmit="return isGoodCode()"&gt;
    &lt;input type="text" name="code"/&gt;
    &lt;input type="submit" value="Use Promo Code"/&gt;
&lt;/form&gt;</code></pre><p></p><h3 id="ae013d19-22d3-4f63-8f83-197537c74199" data-toc-id="ae013d19-22d3-4f63-8f83-197537c74199">Inexact Validation</h3><p>Using incorrect regular expressions can introduce security vulnerabilities.<br>Example: A validation that aims to prevent numbers in a username but mistakenly allows special characters.</p><pre><code class="language-js">// TestUsername.js
// Returns true if the username does not contain digits
function isGoodUserName(username) {
    var re = /^[D]+$/; // only matches if the input does not contain digits
    return re.exec(username) == null;
}</code></pre><p></p><h2 id="9620a1cb-9011-40e6-9f5f-e182b4446e56" data-toc-id="9620a1cb-9011-40e6-9f5f-e182b4446e56">Best Practices for Data Validation</h2><h3 id="b9919a2b-a377-4754-b17d-aee2c8f364c5" data-toc-id="b9919a2b-a377-4754-b17d-aee2c8f364c5">Ensuring Server-Side Validation</h3><p>Always validate on the server to block manipulation attempts in the client.</p><pre><code class="language-json">// SubmitPurchase.js
if(parameters.submit_purchase != null &amp;&amp; parameters.submit_purchase.length &gt; 0) { 
    submitpurchase();
} else {
    return "User is unauthorized to submit a purchase";
}</code></pre><p></p><h3 id="0947ec75-672f-49a9-b934-09bd727c0e98" data-toc-id="0947ec75-672f-49a9-b934-09bd727c0e98">Server-Side Validation for Promo Codes</h3><pre><code class="language-javascript">// ValidatePromo.js
var good_codes = ["1234", "8675", "31415"];
if (parameters.code != null &amp;&amp; parameters.code.length &gt; 0) {
    if(good_codes.indexOf(code) == -1) {
        return "Bad Promo Code";
    }
}</code></pre><p></p><h3 id="fce1278e-428a-4ea6-865c-4df8dbb7da41" data-toc-id="fce1278e-428a-4ea6-865c-4df8dbb7da41">Proper Regular Expressions</h3><p>Using <strong>whitelists</strong> instead of <strong>blacklists</strong> is recommended.<br>Example of a properly designed regular expression for username validation:</p><pre><code class="language-js">// TestUsername.js
// Ensures the username contains only valid characters
function isGoodUserName(username) {
    var re = /^([a-zA-Z]+[a-zA-Z'- ]*)|([a-zA-Z'- ]*[a-zA-Z]+)$/;
    return re.exec(username) != null;
}</code></pre><p></p><h2 id="629e0023-01f0-404c-9048-a13a44972b43" data-toc-id="629e0023-01f0-404c-9048-a13a44972b43">🔗 More Resources</h2><ul><li><p><a target="_new" rel="noopener" href="https://regexr.com/">➡ RegExp online</a></p></li><li><p><a target="_new" rel="noopener" href="https://developer.mozilla.org/en-US/docs/Learn/Forms/Form_validation">➡ Client-side form validation</a></p></li><li><p><a target="_new" rel="noopener" href="https://sfcclearning.com/infocenter/content/b2c_commerce/topics/b2c_security_best_practices/b2c_data_validation.php">➡ SFCC Data Validation</a></p></li></ul><hr><h2 id="045b502b-3a53-42ba-8afd-4a65bb02d429" data-toc-id="045b502b-3a53-42ba-8afd-4a65bb02d429"><strong>Recommended Courses</strong></h2><ul><li><p><a target="_blank" href="https://www.sfcclearning.com/course-detail/salesforce-javascript-developer-certified-tests/17822"><strong><u>Salesforce Javascript Developer I - Certification Tests</u></strong></a></p></li><li><p><a target="_blank" href="https://www.sfcclearning.com/course-detail/course-b2c-commerce-developer/17905"><strong><u>Salesforce B2C Commerce Developer - Certification Tests</u></strong></a></p></li><li><p><a target="_blank" href="https://www.sfcclearning.com/course-detail/salesforce-b2c-commerce-architect-certification-tests/17955"><strong><u>Salesforce B2C Commerce Architect - Certification Tests</u></strong></a></p></li><li><p><a target="_blank" href="https://www.sfcclearning.com/course-detail/sfcc-d2c-quick-start-guide/19116"><strong><u>Salesforce Commerce Cloud D2C: Quick Start Guide</u></strong></a></p></li></ul>

Learn best practices for data validation in Salesforce B2C Commerce Cloud. Prevent security threats, avoid common mistakes, and ensure data integrity with client-side and server-side validation.

Salesforce B2C Commerce Data Validation

How Does Data Validation Protect SFCC from Threats?

Discover expert insights, best practices, and in-depth guides on Salesforce Commerce Cloud. Stay ahead with SFCC Success Secrets and optimize your e-commerce strategy today!

Salesforce B2C Commerce Data Validation

Salesforce B2C Commerce Data Validation

Related Posts

Backups in SFCC: What You Need to Protect Your Store

How to Properly Import and Manage Pricebooks in Salesforce B2C Commerce

Preparing for a Go Live on Salesforce Commerce Cloud: Lessons from Real Projects

Why You Should Care About High Scale Price Books in Salesforce

Uncomfortable truths about SFCC (no one tells you this)