> The answer to the question 'how do you know who the user is when they request a server rendered page containing some sensitive data?' is literally the copy/pa

> The answer to the question 'how do you know who the user is when they request a server rendered page containing some sensitive data?' is literally the copy/paste solution to how to do authentication on your API - as in, it's basically the same code that must be implemented on the backend in either case :-) 100% agree. But that (authentication) is not what this thread is about. > The point is it's the same data and mutations, just a different interface over them. There is no security tradeoff of using one over the other. 100% agree again. A properly written application makes no security trade-off here by using an API. But that's because a properly written SPA stack does the work of interpreting the data and it's relationships twice on both the frontend and backend.