Form Validation Disabled
ID |
html.form_validation_disabled |
Severity |
low |
Remediation Complexity |
low |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Html |
Tags |
reliability |
Rationale
novalidate turns off the browser’s built-in constraint validation, so required fields and
type/pattern checks no longer run on submit. This silently removes a layer of immediate
user-facing feedback and lets malformed data reach the server.
<form novalidate> <!-- FLAW — built-in validation disabled -->
<input type="email" required>
</form>
<form> <!-- OK — validation enabled -->
<input type="email" required>
</form>Remediation
Remove novalidate so the browser validates the form. If custom validation is required, run it in
addition to, not instead of, the native constraints.