The security concern is essentially a red herring, for reasons you've already identified. The code running on your server is guaranteed to be yours. That fact doesn't change. Equally unchanged is that you can expect anything from the client. That doesn't mean you can't still use the same code on the client and server (or the same code source if its some kind of code generator) to ease development pain and get an optimal user interface.
The only real concern is structuring your app in a way where you know things like private keys aren't accidentally world readable, which gets more complicated (from a discipline perspective) in a world where you are using a single language and sharing code across the client and server.
I did not mean to suggest that one cannot, or should not, use the same code on client and server. It's a good idea. What I suggest is that -- in your words -- it requires "discipline". Such discipline is a conscious process, one which requires the programmer to be fully aware of where the client/server dividing line is. When you abstract away that dividing line you make the discipline harder.
Comments
The security concern is essentially a red herring, for reasons you've already identified. The code running on your server is guaranteed to be yours. That fact doesn't change. Equally unchanged is that you can expect anything from the client. That doesn't mean you can't still use the same code on the client and server (or the same code source if its some kind of code generator) to ease development pain and get an optimal user interface.
The only real concern is structuring your app in a way where you know things like private keys aren't accidentally world readable, which gets more complicated (from a discipline perspective) in a world where you are using a single language and sharing code across the client and server.
I did not mean to suggest that one cannot, or should not, use the same code on client and server. It's a good idea. What I suggest is that -- in your words -- it requires "discipline". Such discipline is a conscious process, one which requires the programmer to be fully aware of where the client/server dividing line is. When you abstract away that dividing line you make the discipline harder.