Backend Validation: AI Will Find the Gaps Your UI Hides

Your checkout page features a discount field: type in a code, the price decreases by 10%, but entering an incorrect code causes the button to turn grey. You've tested it and confirmed it functions correctly – however, have you considered the backend validation that supports it? Now, examine the data transmitted from the browser when you execute the checkout: the cart details, the discount code, and, surprisingly, a calculated total worked out by the server itself.

If the server accepts that total without validation, the only barrier preventing a 100% discount is the JavaScript running within the customer's browser, which they control. Although this scenario may seem hypothetical, it aligns with OWASP's examples, such as an API that permits hosts to modify the total_stay_price field—an action they shouldn't be able to carry out (OWASP API3).

Such vulnerabilities often go unnoticed because identifying them necessitates a diligent human with developer tools active—no longer the case. Server-side validation, enforcing every rule on the server rather than merely the page, is now an essential requirement for any live application, as AI has made discovering these gaps both cost-effective and rapid.

This article delves into why, the gaps AI uncovers first, a checklist, and a quick self-assessment for you and your development team. TL;DR: Your frontend serves as a suggestion only. Any entity can disregard a browser-based rule by sending requests directly, and AI tools now execute these at speeds exceeding human capability. This isn't solely an issue for attackers; AI assistants and automated tools also interact with your application in ways your UI never anticipated—treat each request as if it originated outside your page.

Address this through server-side validation. Validate every input, verify ownership for every record, accept only anticipated fields, independently recalculate prices and statuses, implement rate limiting, and maintain unassuming error messages.