How to separate the work of the server and the client in terms of security?

Question

Canvas

When writing a game, the question arose, how to separate the application logic? (Server part - Node JS, client part - Canvas HTML5)
To avoid cheating, data forgery, you need to lock all the logic on the server, and leave only the display on the client, or what? Perhaps there are some other options ... And do the calculations greatly affect the performance of Node? Let's say that each step is calculated according to some not very complicated mathematical formula

Answer 1

Count both on the server and on the client, so as not to constantly drive results between them, but sometimes compare. If the client does not make comparison requests, but makes other requests, or its data differs from the server's, then it is a cheater - block it. The node is not very good at long calculations, but if the formula is very simple and you don't need to calculate the worlds with speck of dust accuracy, then there will be no problem. For client-server communication, use websocket (two-way exchange) and Server-sent Events (one-way broadcast of server events to the client, but much easier to implement and reliable). When exchanging client and server, add some cryptography, for example, constantly changing code, which is used to sign each message between client and server.