I also reached out to them on Twitter but they directed me to this form. I followed up with them on Twitter with what happened in this screenshot but they are now ignoring me.

  • elrik@lemmy.worldEnglish
    51·
    11 months ago

    Yes, but no. Pretty much every application that accepts an email address on a form is going to turn around and make an API call to send that email. Guess what that API is going to do when you send it a string for a recipient address without an @ sign? It’s going to refuse it with an error.

    Therefore the correct amount of validation is that which satisfies whatever format the underlying API requires.

    For example, AWS SES requires addresses in the form UserName@[SubDomain.]Domain.TopLevelDomain along with other caveats. If the application is using SES to send emails, I’m not going to allow an input that doesn’t meet those requirements.

    • xantoxis@lemmy.worldEnglish
      71·
      11 months ago

      Therefore the correct amount of validation is that which satisfies whatever format the underlying API requires.

      You mean the validation which the underlying API will perform on its own? You don’t need to do it.