Backend
What belongs in a backend API
Authentication, permissions, validation, business rules and integration logic should live where they can be tested and maintained.
Keep rules in one place
The API should be the authority for authentication, permissions, validation and business rules. The browser can improve the experience, but it must not be the only place where important restrictions exist.
Clear boundaries make integrations safer and allow the interface to change without rewriting the rules.