Server vs Client generation differences on data validation

From @zanona on March 3, 2016 16:10

I have noticed that most clients that can be generated through Swagger such as javascript will comply to JSON's Schema properties like enum, maxLength, minimum, required, etc for request body (i.e: /users/POST [User Model])

However from what I have tested, all generated server codes such as Node.js, Go, etc, will simply skip that information and leave the API wide open for accepting any kind of payload or wrong property format through the requests, differently than API in the wild such as Github's, Twitter, etc where those will probably filter the payload and block any unwanted data format or analyse of all required properties for the body object have been sent.

Is the fact that most generated servers are not analysing this information something that has been discussed before? It would be interesting to know the reason for validations being only made from client-side generated code leaving the API vulnerable?

Copied from original issue: swagger-api/swagger-core#1693

Start by reviewing the generated Node.js and Go server templates and the existing Swagger/OpenAPI validation behavior. Done would require an agreed scope and evidence that request-body constraints such as enum, maxLength, minimum, and required are enforced; the issue names no specific files or tests.