Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

2
  • 4
    This is the realistic answer. If its simple, straight input data structure validation, then there must be no qualms putting it first. It even protects Access control layer from specially designed inputs/packets. The validation that actually entails secure information leak or guessing, must be placed after access checks. Commented May 4, 2018 at 15:30
  • That assumes answers are public. I dare saying a lot of API's will not even show you the data withou authentication. Commented May 5, 2018 at 18:02