A Single-Page Application (SPA) is a web app that loads a core page once and then updates content dynamically in the browser, usually with JavaScript and background API calls. Navigation, form submits, and data refreshes often happen without a full page reload.
SPAs matter in cyber security because the real application logic is split between the browser and backend APIs. That changes how scanners, testers, and defenders observe the system: older tools may miss routes, state changes, or requests that only appear after client-side rendering. In attacks, SPAs can expose weak APIs, insecure token handling, or client-side flaws such as XSS and broken access control. In defense, security teams test the rendered app, watch API traffic, validate authorization on every request, and use DAST tools that can execute JavaScript and follow modern user flows.