Q:

Web application security: Need a 2 phase check?

(Is this the best forum for this type of question?)
I'm writing a web application which allows approved users to login, and perform various tasks, depending on the security role(s) they have been assigned.
I'm guessing that to prevent users from performing tasks that their roles don't permit, this should probably entail 2 main phases:

Present web pages which contain only the options (menus, pages, buttons, fields, etc) that the user should be able to access, on the web pages.  (This is basically working, already.)
In case a user tries some hacking (e.g. posting fields/values which their webpage doesn't allow them to post), double check all actions before processing them.  (This sounds pretty complex in some areas, to me.)

Does this strategy sound appropriate/normal/necessary?  Any tips or links to pages which discuss this, before I possibly spend a lot of time going down the wrong track?
I'm using Perl/MySQL on Linux, though the principles might be generic.
Thanks.

A:

You're on the right track, but missing one key point: All validation/authentication must be done (or double-checked) by the server, because you cannot trust the client. Maybe you already had this in mind, but it's worth stating explicitly. And yes, you definitely need to do both 1 and 2.
In principle the logic for 1 and 2 should be exactly the same. A type 1 check determines whether a UI element is shown, and a type 2 check determines whether a command gets processed, but the actual checks should be identical. So I'm very curious why you think 2 would be significantly more complex; maybe this points to an architecture problem somewhere.

