Client-side validation should always be assumed to be disabled completely - view it as merely a convenience for your users. Help them switch dates into a correct format, make sure their userids aren't taken before they finish filling out their forms, that sort of thing.
I think the parent of your comment was talking about using SSJS to re-use validation on both ends of the pipe.
Super easy to deal with on a simple ajax request and it's in place for all requests. If a POST/PUT is done with an ajax request simply return the error message. Otherwise, set the HTTP status code and render the form with the error as the response.