Frontend, Backend, Client and Server
Recognize which side of a boundary must change. · Technical Fluency · Lesson 17 · 3 min
Frontend, Backend, Client and Server · 3 min
Situation
“Can we just hide the button?”
An admin-only export is visible to all users. Hiding the button is a frontend change. Preventing unauthorized exports is a backend responsibility too.
A user can send a request without using your interface. The screen is not a security boundary, even if most customers interact only through it.
Mental model
Client and server are roles.
The client requests a service; the server provides it. In a web app, the browser is a client. A mobile app can be another client of the same backend. A server can also act as a client when calling another service.
Frontend usually refers to the user-facing interface. Backend handles shared rules, data, and integrations. Some rendering occurs on servers, so the terms are not perfect synonyms.
Example
Three requests with different scope.
Changing a button label may be frontend-only. Adding a new order status may require database, API, backend, frontend, and analytics changes. Adding an admin permission requires enforcement wherever protected actions occur.
Ask what new information or behavior the interface needs from the system. That reveals why visually small changes can be technically broad.
Failure case
Duplicating the business rule.
Suppose the website allows a refund within 30 days while the mobile app uses 14 days. If each client implements its own authoritative rule, behavior can diverge.
The interface can guide users, but the server should enforce the shared policy. Product requirements should specify one policy and how clients explain rejections.
PM decision
Define the behavior across clients.
If a new capability reaches the web first, what should older mobile versions do? Can they read records created by the new workflow? Will an unsupported state appear as an error?
Discuss compatibility and rollout order with engineering. “The screen is ready” does not mean the whole capability is ready.
Remember this
Ask where the truth is enforced.
The frontend communicates and collects intent. The backend must protect shared rules and data. Locate the boundary before estimating the scope of a change.