Yea this piece is often left out and is kinda the most important. A single set of validation, on the server is required. There are tons of reasonable solutions

Yea this piece is often left out and is kinda the most important. A single set of validation, on the server is required. There are tons of reasonable solutions with different tradeoffs for how you run that validation on the client. But two duplicate sets of validation or client only validation are two very, very dark paths.