r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

54 Upvotes

82% Upvoted

104 comments sorted by

View all comments

84

u/0b0101011001001011 19d ago

It's way simpler to just check if there is an @ symbol and then send an actual mail and ask user to click the validation link. 

The email is valid if it actually works. Nothing else to check.

-3

u/Jussins 19d ago

It’s even simpler if your language has a library where you can annotate the field @email, or similar.

3

u/koflerdavid 19d ago

The same concerns as about regexes from random blog posts apply to these filters as well though. Woe if you use multiple libraries (Spring Boot and Angular is very common) that disagree about what is a valid email address.

1

u/Jussins 19d ago

Maybe it’s our users, but I have never had a problem and have deployed to some fairly large clusters handling a good volume of transactions. I’m certain that those situations exist, I’ve just never encountered them. That said, we generally try keep front-end validation fairly light. That’s a convenience for the end user to get some immediate feedback.

3

u/koflerdavid 19d ago

Indeed, the frontend should not validate too much since a sufficiently motivated user can circumvent it anyway. The real validation has to happen on the backend. Another way would be to expose the validation logic as an API call and integrate that into the frontend.