Recently, I stumbled upon a tutorial discussing authentication in AngularJS. The tutorial showcased an AuthenticationService that was structured similarly to this:
angular.module("auth").factory("AuthenticationService", function ($http, $sanitize) {
function sanitizeCredentials(credentials) {
return {
username: $sanitize(credentials.username),
password: $sanitize(credentials.password)
};
}
return {
login: function (credentials) {
return $http.post("auth/login", sanitizeCredentials(credentials));
}
};
});
The use of the $sanitize service to clean up both the username and password caught my attention. However, it made me question its relevance in this scenario. Typically, $sanitize is employed when user input is directly displayed within html. Wouldn't it be more efficient to handle sanitization on the backend when sending data to the server? After all, frontend validation can easily be bypassed, making server-side sanitation necessary regardless.