Exercise 1: Why the Client-Side Check Provides No Real Security — Possible Solution
====================================================================

WHAT THE CLIENT-SIDE CHECK ACTUALLY DOES
------------------------------
The if (!name.trim()) check inside handleSubmit runs entirely in the user's own browser, as part of the React component's JavaScript. It correctly stops the form's own submit handler from sending a request when the name field is empty, giving the user instant feedback with no network round-trip.

WHY THAT PROVIDES NO REAL SECURITY
------------------------------
Because the check runs in code the browser executes, it only ever applies to whoever goes through that exact form's own UI. Nothing stops a request from reaching the same POST /api/items endpoint by some other means entirely - a hand-written fetch call from the browser console, a curl command, or any other HTTP client - none of which ever execute the React component's JavaScript at all, and therefore never run the check in the first place.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly explains what the client-side check accomplishes (UX, not security) and correctly explains why it provides no real protection: the check is tied to one specific code path (this form's own submit handler), and any request that bypasses that exact code path bypasses the check entirely, regardless of how well the form's own UI behaves.