I haven't tried this yet (I will on my next project), but it seems like an elegant solution to me: Create a validate() sub on the server side, that takes a hashref of params as an argument and returns an error string if anything doesn't validate. Then this can be called from both POST and ajax routes. On the client side, all you need is a bit of code that calls the ajax route with the form params before allowing the POST call to proceed.

Not only does that eliminate duplication, but by not having the validation code on the client side at all, it's more secure, since the client can't look at the page source and see what your validator expects.