CAVEAT: Facilitating interactive and secure client-side validators for ruby on rails applications

Modern web applications validate user-supplied data in two places: the server (to protect against attacks such as parameter tampering) and the client (to give the user a rich, interactive data-entry experience). However, today’s web development frameworks provide little support for ensuring that clientand server-side validation is kept in sync. In this paper, we introduce CAVEAT† , a tool that automatically creates clientside input validation for Ruby on Rails applications by analyzing server-side validation routines. The effectiveness of CAVEAT for new applications is demonstrated by developing three custom apps, and its applicability to existing applications is demonstrated by examining 25 open-source applications. Keywords—Web applications, Data validation, Frameworks