Client-side validation checks user-supplied data in the browser before sending it to a server. It improves feedback and user experience, but it is not a security boundary: users can manipulate client code and bypass these checks. section 9.1.1 section 9.7
Use client-side validation as one layer in a broader request-validation strategy:
- Validate every request again on the server before processing it; server validation remains the source of truth. section 9.1.1
- Prioritize fields containing personal data, including emails, passwords, IP addresses, and special identifiers. section 9.1.1
Prompt length feedback
A React or Next.js interface can set <textarea maxLength={1000} ... /> so users receive an immediate browser-side constraint while entering a prompt. The API handler must still enforce the same limit with server-side validation before processing the request.




