&quot;Never trust the client&quot; is good advice for <i>every</i> kind of application. Clients are filthy liars.<p>Clients have bugs. Old clients don&#x27;t upgrade. Packets arrive out of order. ACKs never make it to clients, causing clients to repeat what the client believes to be a failed operation. All of this is before even considering an attacker actively trying to subvert you.<p>The server should always be the source of truth. It should always enforce all the consistency rules. Database schemas can be a critical tool here as well.<p>Don&#x27;t blindly slap whatever the client sends into a no-SQL database, then vomit it back out for queries.