This is about separation of layers and defined interface contracts which applies both to SPA and traditional server-side rendered pages. Remember mangling with

This is about separation of layers and defined interface contracts which applies both to SPA and traditional server-side rendered pages. Remember mangling with query params back in the time? `.php?param=...`. Now regarding "JS business logic" in SPA, I think it should be only presentation logic (formating, handling input, navigation etc.) and at most some data aggregation from various sources. It needs some real architecting skills to build secure and limited API. Unfortunately often ease is prefered over security for some so I have witnesed Elasticsearch or MongoDB APIs exposed to SPAs without any additional layer.