title: Security considerations and REST vs regular POST login?
body: <p>Is there any reason to not use ReactJS for the login phase, based on observing Facebook's login process?</p>
  
  <p>In writing our, ReactJS based, web application we have made it so that the login process is done via a REST call, which then returns a JSON web token (JWT). This works and so far it hasn't caused any issues, though one person has raised a concern with regards to security.</p>
  
  <p>The person I was speaking to suggested that REST based login sequences are less secure that traditional server side rendered pages, receiving a POST as part of the page request. Two examples given to me were Google and Facebook, which don't use REST during the initial authentication phase, so this got me thinking if this was considered a 'best-practice' in terms of security? My gut feeling is that if the maker of ReactJS is not using React to deal with authentication, then there is probably a good reason? </p>
  
  <p>I am not a security expert, so if anyone can provide good reasoning as to why not to use REST during the login process or why Facebook doesn't use React for login, it would be appreciated.</p>
  
  <p>I did try to see if there has been any other comments on this topic, but I did not find any.</p>