Usually the functionality of the app exists in the backend, which would be server side. No matter what you do on the frontend, there should be no way for you to

Usually the functionality of the app exists in the backend, which would be server side. No matter what you do on the frontend, there should be no way for you to trigger actions in the backend you were not authorized to perform.