Add server-side guard against incomplete steps

[amcoho]

Requirements are:

1. User should be able to visit all previous steps in any random order.
2. User should not be able to go forward beyond the step after last completed step.
3. User should not be able to go forward beyond an incompleted/invalidated step.

Example 1:
User receives an error from server on step 3, say field 3A is too short, goes to step 2, changes field 2A and submits and ends up on step 3. Field 3A should display the short value and the error markup.

Example 2:
User goes back to step 3 from step 4. Enters an invalid value in field 3A clicks on submit and receive an error from server (field value too short) and remains on step 3. He then uses browser button to go forward to step 4. Server-side code should detect that step 3 is invalid and return the user to the step 3.

[smohadjer]

Example 1 is confusing. If user enters invalid value for field 2A and submits he should be taken back to step 2 and not to step 3.

I also don't think example 2 is correct. I think user should be able to go to step 4 using browser forward button. Step 3 is only invalid on his computer, not on server. If he tries to submit invalid data we guard against that, but if wants to jump to other steps, he can do that. Data that he has not posted will be lost. We can notify him about losing data, but we shouldn't stop him from going to other steps. Notification falls under minor enhancements offered to js-enabled users.

[amcoho]

Example 1 did not assume that user entered invalid value for field 2A, if he does, he will remain on step 2.

Re example 2, assume a non-js scenario: User has entered invalid input into a field and is staring at the invalid input and the error we have displayed. Now if he clicks on browser forward button and we allow him to go to next step, he has to wonder whether we accepted the invalid data or not. I think this makes for a confusing UI. Imagine a reservation system where we do not allow booking within three days of event and default to a date four days before the event. The customer overwrites that with a date within two days of event, we show error, he clicks on next step and assumes he gamed the system since there will be no further errors.

[smohadjer]

I’m not sure. You mix terms. When he clicks next step button we still won’t allow him to go forward, only if he clicks links. Links and buttons are two different things. I think a less confusing UI would have buttons that say “Submit” or “Save” and links that say “next step” and “back step”. Also I think you should never write invalid data into database, but from your explanation I understand that you are replacing user’s valid data with invalid one in backend. I think a system that only stores valid data is a better one. On 20. Jul 2018, at 03:00, amcoho <notifications@github.com> wrote: Example 1 did not assume that user entered invalid value for field 2A, if he does, he will remain on step 2. Re example 2, assume a non-js scenario: User has entered invalid input into a field and is staring at the invalid input and the error we have displayed. Now if he clicks on browser forward button and we allow him to go to next step, he has to wonder whether we accepted the invalid data or not. I think this makes for a confusing UI. Imagine a reservation system where we do not allow booking within three days of event and default to a date four days before the event. The customer overwrites that with a date within two days of event, we show error, he clicks on next step and assumes he gamed the system since there will be no further errors. — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

[smohadjer]

Example 1 did not assume that user entered invalid value for field 2A, if he does, he will remain on step 2.

But this requires you to store invalid data in database. When validation is done on client-side (whether by javascript or by browser itself) it doesn't let users submit invalid data to server and hence invalid data will not be stored in such cases and I think server-side validation should do the same. Not only it's reasonable to expect that data we store in a database to be valid, but also if we do so the experience will be consistent with client-side validation. As a user I don't know or care if validation is being done on client-side or server-side, but I expect the same experience. It will be confusing if some forms throw away invalid data and some others don't.

Apart from these, a logic that stores only valid data in database is much simpler to implement.

[amcoho]

No, invalid data will never be saved to the server. Why did you make such an assumption from what I wrote?

[amcoho]

Give me call about this, it will work faster than this back and forth that has just muddled things.

[amcoho]

Note that browser back and forward buttons and back and forward links in the content area are not and cannot behave like each other. They only behave like each other if user sails through step-by-step and not through navigation links e.g. if user jumps to step 5 from step 3 then back button will take him to step 3 but back link will take him to step 4.

[smohadjer]

This is how it works now. I closed an issue that I had opened for this.

[smohadjer]

I made that assumption because you said user can make step 3 invalid and go to step 2 and if he again comes to step 3 he see the invalid data again. This means server is storing invalid data somewhere. I also assumed if he later returns to form, lets say a day later, he still sees the invalid data in step 3 again, for sake of consistency.

[amcoho]

The server would have stored it in session/cookie not in DB but I am backing off from the behaviour I advocated. For this navigation pattern: Step 4 > Step 3 > Invalidate Step 3 > Step 2 > Step 3 I think last visit to Step 3 should show valid date (what was shown when user navigated to Step 3 from Step 4) On navigation away from Invalidated Step 3 to Step 2 we can display a warning tell user that Step 3 has invalid data which will be lost if he navigates away before fixing.

…

------ Original Message ------ From: "Saeid Mohadjer" <notifications@github.com> To: "smohadjer/formwizard" <formwizard@noreply.github.com> Cc: "amcoho" <test123@webserverone.com>; "Assign" <assign@noreply.github.com> Sent: 7/20/2018 10:17:40 PM Subject: Re: [smohadjer/formwizard] Add server-side guard against incomplete steps (#6)

I made that assumption because you said user can make step 3 invalid and go to step 2 and if he again comes to step 3 he see the invalid data again. This means server is storing invalid data somewhere. I also assumed if he later returns to from he sees the invalid data in step 3 again, for sake of consistency. — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#6 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ANTiePcZuHw-QT_slIdg98JtIEad5GvKks5uIrl0gaJpZM4VHCYM>.

[smohadjer]

That's what I suggest too. But we can only display such a warning if js is enabled, right?