Not at all.  It&#x27;s fine for the client to handle processing when the only thing they could hurt is the user of the client.  If the client renders a web page incorrectly, only the user of the client gets hurt by that.  But the server API must not allow a malicious client to do damage that affects other clients.