The g_form API controls the form in the browser: showing fields, setting values and reacting to changes. Client scripts are convenient but run on the client, so they cannot be trusted for data integrity; validation that matters belongs on the server.
Before you start
You should be comfortable with client scripts and business rules. This article covers the client form API and where logic belongs.
Step-by-step walkthrough
Step 1: Use g_form for presentation and guidance
g_form.setMandatory, setVisible and setReadOnly shape the form for the current user, and onChange client scripts react to field changes. These are user-experience behaviors, which is what the client layer is for.
Step 2: Keep real validation on the server
A determined user can bypass a client script, so required and cross-field rules must be enforced server-side with a business rule or data policy. Client validation is a courtesy that improves the experience; server validation is the guarantee.
Step 3: Avoid heavy client scripts
Every client script runs in the browser, so slow or many of them degrade the form’s responsiveness. Prefer declarative UI policies where possible and keep scripts small, moving complex logic to the server.
Worked scenario
The client script shows a field; the server enforces the rule.
// Client script (onChange of category)
function onChange(control, oldValue, newValue) {
g_form.setMandatory('subcategory', newValue === 'hardware');
}Walk through the example
The client script makes subcategory mandatory when the category is hardware, which guides the user. The same rule is enforced by a server business rule, so it holds even if the client script is bypassed. Presentation on the client, enforcement on the server.
Common mistake
Relying on a client script as the only validation, so an API or a bypassed client writes invalid data. Another is heavy client scripts that make the form sluggish.
Verify the behavior
Change the category in the form and confirm the field becomes mandatory. Submit the same change through the API with the field empty and confirm the server rule rejects it, proving enforcement is not client-only. Time the form load with scripts enabled and disabled.
Interview exercise
Why is client-side validation insufficient?
Answer and reasoning
Because it runs in the browser, which the user controls, so it can be bypassed by disabling scripts, editing the payload, or using the API directly. The server is the only place where a rule is guaranteed. Client validation improves experience; server validation guarantees integrity.
Continue learning
Compare client and server boundaries in Client-server boundaries and UI rules in UI policies. Read the ServiceNow g_form documentation and try the ServiceNow interview questions.