<h2 id="808eb961-aab7-4f9a-8df0-639d0656607a" data-toc-id="808eb961-aab7-4f9a-8df0-639d0656607a">Introduction to Data Validation</h2><p>Validation ensures data meets expected formats and requirements. Invalid requests are typically rejected, and an error is returned to users. There are multiple validation points, but this guide focuses on <strong>Client-Side and Server-Side validation</strong>.</p><ul><li><p><strong>Client-Side data validation</strong>: Implemented using JavaScript to check data in the user's browser before sending it to the server.</p></li><li><p><strong>Server-Side data validation</strong>: Added as an extra step in the business flow to validate data type and content before processing.</p></li></ul><p>Salesforce Commerce Cloud recommends performing <strong>light Client-Side validation</strong> to improve user experience but always enforcing <strong>thorough Server-Side validation</strong>, duplicating all client-side checks.</p><p></p><h2 id="33b8c7a9-106f-4f38-bb01-8ac138441dd4" data-toc-id="33b8c7a9-106f-4f38-bb01-8ac138441dd4"><strong>Unlock SFCC Pro Tips!</strong></h2><p><span style="color: rgb(16, 24, 40)">Imagine what you’re missing in our other guides! Stay ahead of the competition, get exclusive pro tips, and master Salesforce Commerce Cloud like never before.</span></p><p>👉 <a target="" rel="noopener noreferrer" href="https://www.sfcclearning.com/subscribe"><strong><u>Subscribe NOW and never struggle with SFCC again!</u></strong></a></p><p></p><h2 id="946fe24a-72f5-4fe6-9b1d-80931e7f7cee" data-toc-id="946fe24a-72f5-4fe6-9b1d-80931e7f7cee">Threats</h2><ul><li><p>Helps prevent injection attacks, such as <strong>Cross-Site Scripting (XSS)</strong>.</p></li></ul><p></p><h2 id="87c16817-e9dc-48fa-a5fc-977ac01a59c6" data-toc-id="87c16817-e9dc-48fa-a5fc-977ac01a59c6">Why is Data Validation Important?</h2><p><strong>Validation ensures that bad or malicious data never enters an application.</strong><br>Duplicating Client-Side checks on the Server prevents attackers from bypassing the front-end and sending manipulated data.</p><p></p><h2 id="f1bacb97-2fe8-470c-9060-5bf68f01997c" data-toc-id="f1bacb97-2fe8-470c-9060-5bf68f01997c">How Does Data Validation Protect SFCC from Threats?</h2><ul><li><p>Client-Side validation provides immediate feedback to users for minor input errors.</p></li><li><p>Server-Side validation ensures malicious users cannot send direct requests with altered data.</p></li></ul><p></p><h2 id="0bb87094-632e-4dee-a331-8742fa009f9b" data-toc-id="0bb87094-632e-4dee-a331-8742fa009f9b">Common Issues in Data Validation</h2><h3 id="f36a21aa-2ed3-4170-8cfc-5807c35554b6" data-toc-id="f36a21aa-2ed3-4170-8cfc-5807c35554b6">Client-Only Checking</h3><p>Disabling a button in the front-end <strong>does not prevent an attacker</strong> from modifying the form via browser developer tools and submitting invalid data.</p><pre><code class="language-html">&lt;!-- authorized_purchase.isml --&gt;
&lt;form action="${URLUtils.httpsContinue()}"&gt;
    &lt;input type="submit" value="Submit My Purchase" disabled="disabled"/&gt;
&lt;/form&gt;</code></pre><pre><code class="language-js">// SubmitPurchase.js
if(parameters.submit_purchase != null &amp;&amp; parameters.submit_purchase.length &gt; 0) { 
    submitpurchase();
}</code></pre><p></p><h3 id="6f75ad4a-418e-40a7-9663-c63f82767f4d" data-toc-id="6f75ad4a-418e-40a7-9663-c63f82767f4d">Exposing Internal Data</h3><p>Validating data in the front-end may expose sensitive internal logic, such as valid promo codes.</p><pre><code class="language-html">&lt;!-- flashsalecodes.isml --&gt;
&lt;form name="myForm" onsubmit="return isGoodCode()"&gt;
    &lt;input type="text" name="code"/&gt;
    &lt;input type="submit" value="Use Promo Code"/&gt;
&lt;/form&gt;</code></pre><p></p><h3 id="ae013d19-22d3-4f63-8f83-197537c74199" data-toc-id="ae013d19-22d3-4f63-8f83-197537c74199">Inexact Validation</h3><p>Using incorrect regular expressions can introduce security vulnerabilities.<br>Example: A validation that aims to prevent numbers in a username but mistakenly allows special characters.</p><pre><code class="language-js">// TestUsername.js
// Returns true if the username does not contain digits
function isGoodUserName(username) {
    var re = /^[D]+$/; // only matches if the input does not contain digits
    return re.exec(username) == null;
}</code></pre><p></p><h2 id="9620a1cb-9011-40e6-9f5f-e182b4446e56" data-toc-id="9620a1cb-9011-40e6-9f5f-e182b4446e56">Best Practices for Data Validation</h2><h3 id="b9919a2b-a377-4754-b17d-aee2c8f364c5" data-toc-id="b9919a2b-a377-4754-b17d-aee2c8f364c5">Ensuring Server-Side Validation</h3><p>Always validate on the server to block manipulation attempts in the client.</p><pre><code class="language-json">// SubmitPurchase.js
if(parameters.submit_purchase != null &amp;&amp; parameters.submit_purchase.length &gt; 0) { 
    submitpurchase();
} else {
    return "User is unauthorized to submit a purchase";
}</code></pre><p></p><h3 id="0947ec75-672f-49a9-b934-09bd727c0e98" data-toc-id="0947ec75-672f-49a9-b934-09bd727c0e98">Server-Side Validation for Promo Codes</h3><pre><code class="language-javascript">// ValidatePromo.js
var good_codes = ["1234", "8675", "31415"];
if (parameters.code != null &amp;&amp; parameters.code.length &gt; 0) {
    if(good_codes.indexOf(code) == -1) {
        return "Bad Promo Code";
    }
}</code></pre><p></p><h3 id="fce1278e-428a-4ea6-865c-4df8dbb7da41" data-toc-id="fce1278e-428a-4ea6-865c-4df8dbb7da41">Proper Regular Expressions</h3><p>Using <strong>whitelists</strong> instead of <strong>blacklists</strong> is recommended.<br>Example of a properly designed regular expression for username validation:</p><pre><code class="language-js">// TestUsername.js
// Ensures the username contains only valid characters
function isGoodUserName(username) {
    var re = /^([a-zA-Z]+[a-zA-Z'- ]*)|([a-zA-Z'- ]*[a-zA-Z]+)$/;
    return re.exec(username) != null;
}</code></pre><p></p><h2 id="629e0023-01f0-404c-9048-a13a44972b43" data-toc-id="629e0023-01f0-404c-9048-a13a44972b43">🔗 More Resources</h2><ul><li><p><a target="_new" rel="noopener" href="https://regexr.com/">➡ RegExp online</a></p></li><li><p><a target="_new" rel="noopener" href="https://developer.mozilla.org/en-US/docs/Learn/Forms/Form_validation">➡ Client-side form validation</a></p></li><li><p><a target="_new" rel="noopener" href="https://sfcclearning.com/infocenter/content/b2c_commerce/topics/b2c_security_best_practices/b2c_data_validation.php">➡ SFCC Data Validation</a></p></li></ul><hr><h2 id="045b502b-3a53-42ba-8afd-4a65bb02d429" data-toc-id="045b502b-3a53-42ba-8afd-4a65bb02d429"><strong>Recommended Courses</strong></h2><ul><li><p><a target="_blank" href="https://www.sfcclearning.com/course-detail/salesforce-javascript-developer-certified-tests/17822"><strong><u>Salesforce Javascript Developer I - Certification Tests</u></strong></a></p></li><li><p><a target="_blank" href="https://www.sfcclearning.com/course-detail/course-b2c-commerce-developer/17905"><strong><u>Salesforce B2C Commerce Developer - Certification Tests</u></strong></a></p></li><li><p><a target="_blank" href="https://www.sfcclearning.com/course-detail/salesforce-b2c-commerce-architect-certification-tests/17955"><strong><u>Salesforce B2C Commerce Architect - Certification Tests</u></strong></a></p></li><li><p><a target="_blank" href="https://www.sfcclearning.com/course-detail/sfcc-d2c-quick-start-guide/19116"><strong><u>Salesforce Commerce Cloud D2C: Quick Start Guide</u></strong></a></p></li></ul>

Learn best practices for data validation in Salesforce B2C Commerce Cloud. Prevent security threats, avoid common mistakes, and ensure data integrity with client-side and server-side validation.

Salesforce B2C Commerce Data Validation

How Does Data Validation Protect SFCC from Threats?

Discover expert insights, best practices, and in-depth guides on Salesforce Commerce Cloud. Stay ahead with SFCC Success Secrets and optimize your e-commerce strategy today!

Salesforce B2C Commerce Data Validation

Salesforce B2C Commerce Data Validation

Related Posts

Bad Data Travels Fast in SFCC. Validate It Before It Spreads

Data purging in SFCC is not housekeeping. It is architecture.

SFCC Integrations: The Endpoint Working Is Not Enough

SFCC Cache: Fast Is Useless If It’s Wrong

Your SFCC jobs don’t fail in production. They fail in design.