Server-side is probably the right place to fix it, but I tend to be impatient when it comes to security.