Server-side validation
Also called: Back-end validation
Checks the server runs on every request, no matter which app or tool sent it. The only validation you can trust.
Definition
The server repeats the app's rules and adds checks only it can do, such as "email already registered", stock levels or rate limits. If the data is invalid it answers with an error (often 400 or 422) and saves nothing. Testers check it by sending invalid data straight to the API, around the app.
In practice
The app blocks users under 18, but a tester sends a sign up request from Postman with a 2012 date of birth. The server must reject it with a validation error.
Learn it in context
Lessons that use this term.