type="email" is not being validated on the server about remix-validity-state HOT 6 CLOSED

ok cool. yeah the URL spec is nasty but since node has URL available globally, I think we can get by with try { new URL(value); } catch (e) { return false } on the server. If folks are running in non-node environments, they'll need URL available which should be fine for most alternative server-worker-API based environments.

Thanks for the references!

from remix-validity-state.

Yeah this is currently a "by design" case since I'm not sure what exactly the browsers are all doing internally for their type validations. Client-side we just let the browser tell us when an input is valid. Server-side we have to re-implement the same checks (see builtInValidations in the library code). Things like required and minLength are simple to re-implement, but I've not yet bothered with the type validations.

I'm definitely not interested in some nasty regex to try to validate email addresses. Mostly because they're horrible to debug and generally gives tons of false negatives. I'd definitely also recommend giving this post a read - this changed how I thought about email addresses significantly many years ago.

I think I could be convinced to do something very simple on the server such as /.+@.+/ to make sure there's something before and after an @ character but I doubt I'd want to go any further. I'll also need to look into what that would mean for the rest of the inputs (type url, tel, date, etc.) since if I do one I'd prefer to do them all and unsure at the moment if that opens up a can of worms.

For now, I'd recommend doing your own simple regex-based check. In the end though, the proper way to validate an email address on the server is to send it an email with a verification link :)

from remix-validity-state.

Here's the standard browsers adhere to along with a fairly non-convoluted regex that satisfies it and doesn't overly restrict: https://html.spec.whatwg.org/multipage/input.html#valid-e-mail-address. I think if using type=email prevents international emails addresses, then it's okay to do so on the server too and the user can override if they please

from remix-validity-state.

Oh cool I didn't know the spec gave their own regex, that's handy. I'll do some digging on the rest of the types as well. I hope (but doubt) they'll all be so easy 🤣

from remix-validity-state.

Oh I thought this was already being done in a previous version.

There are only two type's that have intrinsic validation: email and URL.

I couldn't find the regex/validation code for a URL, but here's the spec.

from remix-validity-state.

Released in 0.10.0

from remix-validity-state.