In a three-tier web architecture, which tier is responsible for business logic, and why should it never be implemented purely in the presentation tier?

• A.Business logic should be split between all three tiers for performance optimization
• B.Modern SPAs require business logic in the presentation tier because the backend is stateless
• C.Business logic should be in the database tier for consistent enforcement via stored procedures
• D.Business logic belongs in the application/middle tier; the presentation tier (browser/client) is entirely attacker-controlled - any logic placed there can be bypassed, modified, or disabled. A user can disable JavaScript, use browser DevTools, or intercept HTTP traffic to skip client-side validation and business rules entirely