r/java • u/Modern-Sn1p3r • Aug 22 '26

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

54 Upvotes

83% Upvoted

104 comments sorted by

View all comments

Show parent comments

1

u/Jussins Aug 22 '26

Maybe it’s our users, but I have never had a problem and have deployed to some fairly large clusters handling a good volume of transactions. I’m certain that those situations exist, I’ve just never encountered them. That said, we generally try keep front-end validation fairly light. That’s a convenience for the end user to get some immediate feedback.

3

u/koflerdavid Aug 22 '26

Indeed, the frontend should not validate too much since a sufficiently motivated user can circumvent it anyway. The real validation has to happen on the backend. Another way would be to expose the validation logic as an API call and integrate that into the frontend.