"Never trust the client" is good advice for every kind of application. Clients are filthy liars.
Clients have bugs. Old clients don't upgrade. Packets arrive out of order. ACKs never make it to clients, causing clients to repeat what the client believes to be a failed operation. All of this is before even considering an attacker actively trying to subvert you.
The server should always be the source of truth. It should always enforce all the consistency rules. Database schemas can be a critical tool here as well.
Don't blindly slap whatever the client sends into a no-SQL database, then vomit it back out for queries.
Clients have bugs. Old clients don't upgrade. Packets arrive out of order. ACKs never make it to clients, causing clients to repeat what the client believes to be a failed operation. All of this is before even considering an attacker actively trying to subvert you.
The server should always be the source of truth. It should always enforce all the consistency rules. Database schemas can be a critical tool here as well.
Don't blindly slap whatever the client sends into a no-SQL database, then vomit it back out for queries.