> I'd argue that it shouldn't ever be done in Javascript, because that means implicitly trusting the client, which is always a bad idea. It absolutely shouldn'

> I'd argue that it shouldn't ever be done in Javascript, because that means implicitly trusting the client, which is always a bad idea. It absolutely shouldn't be done in Javascript only.