ruby on rails - RoR security with POST method: where - how occurs the validation - howto optimize? -

in forums made experience newbies getting not helpful answers (to describe former experiences nicely) when asking questions things obvious more experienced users. please excuse fear 1 of questions - nevertheless want understand , hope can explain following me in simple words?

how ror behave security perspective - when post used?
in specific:

1. validation occur in belows example
1.1 serverside?
1.2 clientside?
1.3 both?
1.3.1 if both, remaining points should sorted...(right?)

class article < activerecord::base   validates :title, presence: true,                     length: { minimum: 5 } end 

2. if validation occurs on server site:
2.1 couldn´t lead situation uses script "overload" server such invalid requests , keeping server busy wont respond other requests?
2.2 there (an additional) clientside validation performed (or implemented if isn't handled) bypassing clientside validation entering url post strig directly flood server useless requests (traffic, ram,...)?
3. in case validation occurs on client side:
3.1 attacker bypass triggering (guessed) post string browser directly , insert db dont want see there?
3.2 how mitigate that?

i not sure if explain thoughts enough no programmer nor hacker, work related lot business logic , processes question how post behaves , how ror handles keeps brain busy.

your time crafting short answer in simple words appreciated.

the validation in above case happen on server side.

2.1 invalid requests, if trying abuse system flooding invalid requests ( may form posts or otherwise ) might lead denial of service (dos) should consider using tools fail2ban, there many tools handle abusive clients may want google , figure out works best in setup.

2.2 ideally should have client side validation, leads better user experience , using tools , services handle dos or ddos should take care of abusive clients

3.1 have server side validations , db level constraints. data integrity paramount, ideally should perfect condition irrespective of client or framework use.

3.2 server side validations , db constraints maintain data integrity.

these questions , worrying security good.

for dos or ddos attacks can't in code, although these problems have been solved before should lot of information on them, googling them.

for stuff should careful in code, read:

http://guides.rubyonrails.org/security.html

also, http://blog.honeybadger.io/ruby-security-tutorial-and-rails-security-guide/