Your API-Centric Web App Is Probably Not Safe Against XSS and CSRFMost of the developments I’ve participated in recently follow the “single-page application based on a public API with authentication” architecture. Using Angular.js or React.js, and based on a RESTful API, these applications move most of the complexity to the client side. But as we’re reinventing web applications, we need to reinvent web application security, too. Is an API-centric architecture vu
