Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Form validation is one of the most common full-stack tasks because the same rule appears in the UI, API contract, and domain model. The design needs fast feedback without trusting the browser as the only guard.
I would validate in both places, but with different responsibilities. The UI gives immediate feedback for required fields, formats, length, and simple cross-field rules. The API still validates the request DTO and domain rules because clients can be old, buggy, or malicious. The API returns a consistent validation error shape, and the UI maps field errors back onto the form while also showing a summary for non-field errors.