Hello,
Nothing is stopping users from calling submitForm() in the browser, in fact their is nothing keeping the user from running whatever html, css, or javascript on any webpage whether that be online banking or google.com. This is why in the SDK documentation Q2 recommends that developers do python(server-side) validation on the input also.
-Trey
Thank you for the info. In the tutorials shown on server-side validation, they mainly center around a user pressing a button to execute submitForm() and denying this button from calling the function. What I don't see is how a user cannot circumvent all of the validation done in the tutorials by running submitForm() in the console. I think the core of my question is this: if we have to provide the next route as a routing_key in get_tecton_form(), how can we use Q2's tech to prevent a user from just using submitForm() to proceed to that specified route? Can we force a different route?
On that specific destination route you need to check the data and make sure it is what you are expecting, sure you can force a different route. If it is in the same extension.py you can just do return route_function_name() server side validation is mentioned, how to do it doesn't seem to be shown.