Single-page applications (SPAs) built with React, Angular or Vue load one page and then build everything else with JavaScript and background API calls. Traditional crawlers that follow HTML links see almost nothing.

How it works

In an SPA, navigation happens in the browser and data arrives through XHR or fetch requests to an API. To test it properly, a scanner has to run the JavaScript like a real browser and capture those background requests, because that is where the real attack surface lies.

Why it matters

• Link-following crawlers miss most of an SPA's functionality.
• The API behind an SPA is often the most exposed part of the system.
• Client-side issues such as DOM XSS only appear when the JavaScript runs.

Best practices

• Use a scanner with browser-based discovery.
• Record key user journeys so the scanner can replay them.
• Import the API definition (such as OpenAPI) to test endpoints the UI rarely calls.
• Check the sitemap after the scan to confirm what was reached.

How Vooki Pro helps

• Discovers background XHR and fetch endpoints with browser-based discovery, enabled by default.
• Replays browser recordings of your key user journeys, alone or combined with crawling (hybrid mode).
• Tests for DOM-based XSS, client-side prototype pollution and unsafe JavaScript patterns.
• Shows the discovered sitemap and a Scope view of scanned and unscanned URLs.

Frequently asked questions

Why do traditional crawlers struggle with SPAs?

SPAs build pages with JavaScript and load data through background API calls, so there are few HTML links to follow.

How do I cover an SPA's API?

Use browser-based discovery to capture XHR and fetch requests, and import the API definition if you have one.

Related: Authenticated scanning: why you must scan behind the login · Using browser recordings to test deep workflows