The Shift to JSON
Think of a traditional bank teller window. You walk up, ask for your balance, and the teller reads it to you — you never see the ledger. That's how old web applications worked: the server prepared a finished HTML page and sent it to your browser, like a teller reading you only what you needed to hear.
Modern applications work differently. A React frontend or mobile app is more like a self-service kiosk that talks directly to the bank's database over a structured protocol. The server returns raw data — usually JSON — and the client decides how to display it. That protocol is an API (Application Programming Interface): a defined contract for how software components communicate.
This architectural shift has a profound security consequence. In the old model, the server controlled what you saw. In the new model, the server sends data and trusts the client to hide what it shouldn't show. That trust is routinely misplaced.
Old Way: "Please show me the Receipt Page." → Server renders only what you're allowed to see.
New Way: GET /api/receipts/1001 → Server returns raw data; the app decides what to render.
If the developer isn't careful, the API becomes a direct pipeline to the database, bypassing security controls that used to exist in the UI layer. The attack surface is now the API itself — its endpoints, its parameters, its response payloads. This is why OWASP maintains a dedicated API Security Top 10 list, separate from the standard web application Top 10. The threats are distinct enough to warrant their own taxonomy.