title: ASP.NET MVC JQuery data-val-regex-pattern security
body: <p>A lot has been written about not relying on client validation only; it's just a convenience for the user and reduces server processing. THIS IS NOT WHAT THIS QUESTION IS ABOUT.</p>
  
  <p>I don't know if this is specific to ASP.NET MVC or all JQuery validation, but this is where my question comes from. When you use the ReqularExpressionAttribute with clientsidevalidation enabled, the HTML outputs with something like: data-val-regex-pattern="^[0-9a-zA-Z]{3,12}$" just to throw a basic example.</p>
  
  <p>Isn't this rather insecure, giving away explicitly what your expression is checking for and isn't checking for? It seems like it's much easier to exploit holes in a validation scheme when a user can easily read exactly what it is. And it's the same expression that the server uses, so they can see what the server checks for too.</p>
  
  <p><b>UPDATE</b></p>
  
  <p>My example expression isn't very good for describing the problem. It's about more complex data values that have very strict formats and you unintentionally overlook some loopholes</p>