As a frontend dev I give him the first point, API versioning, but none of the other. For example:<p>2. Validation<p><pre><code> > With Spring MVC, you add the validation annotations on the Java code and Thymeleaf can display them when something is wrong.
</code></pre>
In the same way the backend can respond with the problems in a 4xx<p>3. Security<p><pre><code> > [In SSR], it is for instance trivial to not render a ‘delete’ button if the user is not an administrator.
</code></pre>
Conditionally rendering a delete button has nothing to do with security.<p>4. Secured file downloads<p><pre><code> > With a SSR application, you can have a normal <a href=".."/> and the security aspect is handled on the server via the session.
</code></pre>
An SPA can have normal links as well. But the main problem here is implying that you can handle that security on the client.<p>---<p>SSR for CRUD apps is fine, but this article critiquing SPAs with innacurate examples, and in cases equating them with bloated tech.