When designing a web based client server application with single application server and database cluster backend, input validation should be performed:

Client-side validation enhances user experience but is easily bypassed by malicious users, making it insufficient for security purposes.

While database stored procedures can enforce some data integrity, relying solely on them means invalid or malicious data might still reach the application server and its logic, potentially causing vulnerabilities or errors before database-level checks occur.

The application server is the authoritative backend component that processes client requests and interacts with the database; validating input here ensures all data, regardless of its origin or bypass attempts, adheres to security and business rules before further processing or storage, preventing common vulnerabilities like SQL injection or cross-site scripting.

HTTPS encrypts communication between the client and server and verifies data integrity during transit, but it does not perform validation on the actual content or format of the input data itself.