For MPAs security is as "simple" as: - Throwing away everything you don't need. - Don't trust inputs. Actually you shouldn't trust anything - not even this com

For MPAs security is as "simple" as: - Throwing away everything you don't need. - Don't trust inputs. Actually you shouldn't trust anything - not even this comment. - Since you dont trust inputs, add a version tag for all you input because your app will evolve. - Sanitize all input (ints should be ints, not drop database strings for instance). - Assume system/framework/service calls can fail. Log that. - Check your routes. Some frameworks expose routes that you didn't knew about until some bastard asks Googlebot the path to remove some data and drives you mad for weeks. - Remember to log all input data for further analysis. Well, maybe not all; but 1-5% of all (and tell users about that and dont' use that data for other stuff). For me Javascript is good for small stuff. Maybe a simple "micro" service that updates something is good. Angular, React, and friends are too much for me because I need too much stuff to debug a simple app. And don't misjudge the programmer time. Some frameworks allow you to start iterating quickly, but debugging is a nightmare. Also, don't use two (or more) technologies at the same time that you are still learning. One is fine, but learning two at the same time makes debugging #@!ng hard.