It really depends on your use-case. I used to have most of the business logic in the web client, but over time I have come to see that you can implement greater integrity by not exposing CRUD-like operations over HTTPS.
I have even written an article about it: https://blog.gendocu.com/posts/grpc-web-on-aws/