So far, we've taken the happy path. But that just won't do in real life. No we must always assume that the user is malicious. For this reason, both client and server-side validation is a must.