Yes, you are right you really need the server-side part to prevent bad things.