It depends what you’re after.
If you want a true authoritative scenario, then the server should spawn the projectile which then replicates to all of the clients.
However, if you want to create a more lag free environment you can take a “riskier” route by having the client spawn the projectile and then telling the server that it hit. To “secure” it, you’ll want to do a whole bunch of calculations to ensure that the projectile could have done what the client said it did. This of course only works if you have a projectile that is really predictable, a grenade like projectile which randomizes its bounce direction wouldn’t be possible to reliably secure for example.
In UE4, projectile movement usually is predicted on the client / server though … at least they were in UE3.