Hacker News Reader

Some will have to be in the JS, but that isn't really any different from non-SPA web apps. They still serve up JS files that have business logic. JS and business logic are, to some degree, inseparable.

If you're giving trust to a user to query the API, they could also maliciously leak data or execute queries inside a normal web app just as easily if you build something appropriately secure.

View on HN

This is about separation of layers and defined interface contracts which applies both to SPA and traditional server-side rendered pages. Remember mangling with query params back in the time? `.php?param=...`. Now regarding "JS business logic" in SPA, I think it should be only presentation logic (formating, handling input, navigation etc.) and at most some data aggregation from various sources.

It needs some real architecting skills to build secure and limited API. Unfortunately often ease is prefered over security for some so I have witnesed Elasticsearch or MongoDB APIs exposed to SPAs without any additional layer.

Reply on news.ycombinator.com