Check flow data and rules
The server may check fields, request types, routes, addresses, or rules depending on the module. Scope is specific to the endpoint and version.
Help Centre · Security and data
Why can an action be rechecked server-side?
The dossier confirms server-side validation for certain fields, request types, routes, addresses, or rules. These validations are specific to the documented module, endpoint, and version.
Validation is not universal.A control observed in one endpoint should not be assumed to exist in every other flow.
The server may apply its own checks
In documented flows, the server may validate fields, the request type, a route, an address, or a module-specific rule. The result can therefore differ from a value prepared in the interface. The dossier states that these validations are specific to the endpoint and version.
01Scope
Distinguish three mechanisms
They all contribute to technical operation, but they do not have the same role and should not be confused.
Add an anti-abuse signal
App Check and reCAPTCHA Enterprise are documented for configured functions, including Web forms. The dossier states that they do not replace server-side validation.
Provide a specialized result
HERE and/or OSRM may be used for geocoding and routes depending on the flow. Quality depends on addresses, keys, and service availability, among other factors.
02Documented examples
Three contexts where controls differ
These examples show why the exact flow should be identified before concluding that a result is abnormal.
Anti-abuse and flow validation
Documented forms may use App Check or reCAPTCHA Enterprise in addition to server validation specific to the function.
Specialized geocoding or routing
HERE and/or OSRM may be involved depending on the flow. The result depends on the supplied data and service availability.
Authentication and deployed rules
A protected flow may depend on Firebase Authentication, a group control, and the Firestore rules actually deployed.
03Diagnosis
Document the exact flow
If the result is unexpected, record what helps reproduce the case without sending secrets or unnecessary personal information.
Journey and page
Record the exact journey and page used.
Account context
Indicate the account type or context without a sign-in identifier.
Attempted action
Precisely describe the action performed before the unexpected result.
Useful information
Keep only the non-sensitive elements needed to understand or reproduce the case.
Expected result
Explain what you expected to observe based on the journey and configuration.
Observed result
Copy the exact message and describe the actual behaviour obtained.
Date and sanitized evidence
Add the approximate date and time and a sanitized screenshot if it helps the diagnosis.
Security instruction: never send a password, authentication code, key, token, or secret.
Guardrails
What this article does not guarantee
This page describes mechanisms confirmed by component. It does not mean every action is revalidated in the same way.
- An exhaustive list of every validation in the platform.
- Identical server-side revalidation for every action.
- That App Check or reCAPTCHA replaces server-side validation.
- The absolute absence of errors, abuse, outages, or unexpected results.
Related resources
Continue the review
Choose the resource that matches the organizational, functional, or technical question you need to clarify.
Security and data
Explore guides about data categories, roles, and server-side validations.
View the Security and data collection →Security
Review an accessible presentation of documented access categories, validations, and technical mechanisms.
Explore the Security page →How do you prepare an effective support request?
Gather useful context, steps, and results before contacting support.
Prepare a support request →Architecture and server-side validations
Learn how the interface prepares a request and why certain information may be rechecked server-side.
Understand the validation architecture →Support
Contact supportDocument an unexpected result
If a validation produces a result you do not understand, note the flow, page, action, date, expected result, observed result, and exact message. Clean screenshots and do not send secrets.