It is IDEAL to do both client-side and server side validation - because you can only trust the client as far as you can throw them.

Now, you might not have big security policies at your workplace - but any developer caught using just client-side validation would be replaced by end of day.