On my site I use Angular and the $http
object to send an email. It's just a simple contact form. I validate the email and make sure the required fields have been filled with a simple regular expression.
Even with server-side languages, there's still not really away to validate emails as far as I know. (See this question.) The most I could really do is apply the same basic regex.
Since I'm sending the email with a client side script (I don't even support people who have JS disabled anymore. A good discussion here on that.) and the email will not send unless the user has JavaScript enabled, is there really any need to validate on the server-side?
Is there a general rule of thumb for when you need to use server-side validation?
Since I'm sending the email with a client side script … is there really any need to validate on the server-side?
You have no control over what people send in HTTP requests to your server.
While they can't simply submit a form to get the expected result (which is a shame, since JS can fail for many reasons other than simply being disabled on the client), they can still read your code and/or use their browser tools to determine the API of your webservice. Given that information, it is trivial to build a client to send whatever data (including malicious data) they like to it.
Is there a general rule of thumb for when you need to use server-side validation?
Yes. You always need server-side validation. Client-side validation is there only as a convenience (faster / better UI) for the visitor.