Filtering should normally happen server-side when the dataset is large, security-sensitive, paginated, or shared across users. The database can use indexes and return only authorized rows. Client-side filtering is reasonable for a small dataset already fetched for display. Treat client filters as requests, never authorization. Accept an allow-listed filter model, validate ranges and sort fields, apply authenticated RestaurantId and OutletId first, project required columns, and cap page size. Prefer keyset pagination for deep or changing lists. Return filter metadata when it helps the UI, and preserve filters in the URL. Measure query plans and response sizes; moving a slow unindexed scan behind an API does not solve it.
Backbencher Developer · · 0 likes