Validate Input From Client
As with proper web application security, all input from the client should be must be treated as untrusted. Services must thoroughly filter and validate input from the app and user. Proper sanitization includes all user input before transmitting and during receipt.