Vaadin 7.6.2
Where exactly is validation performed in Vaadin? Server side or client side or both? Obviously, I'm interested in both, but it's critical that server side validation always occurs.
Out of the box, validation always happens on the server in Vaadin. You could write client components that do client-side validation before sending input to the server, but this is not typical/standard.
See for instance TextField.addValidator(), and an example here: http://www.tnwblog.com/vaadin-component-validation.html
See also the related concept of Forms and data binding: https://vaadin.com/docs/-/part/framework/datamodel/datamodel-itembinding.html