I have been proposed a solution where our API serves up some JavaScript which will be executed on the client. The code will render some HTML on the client and provide some functionality such as calling other APIs and verifying info entered into the dynamically rendered elements.
In essence it would do everything a programmer would do if they wanted to call this API, we are just providing a pre-packaged version of all that. So the rendered HTML and JavaScript wouldn't be doing anything that we wouldn't be doing on the client anyway.
From an initial walkthrough I can't see anything insecure with this approach so long as the API we are executing the JavaScript from is trusted. are there any major security flaws with this approach?
EDIT
I am not an expert in security, but here is a hopefully better explanation of my concerns.
If a hacker gets into our system, the API is the last thing we are worried about because we have a bunch of other more valuable things he will want. However, if this API which serves dynamic JavaScript makes it any easier for a hacker to get in then that becomes a concern.
Additionally, I have always been skeptical of dynamically executing code, I have been taught under the notion that it is inherently insecure, which is why I am asking this question in the first place. Admittedly I don't see why it is insecure unless the dynamic code is being generated from user input, so my other concern is, are there any inherent security holes in running this dynamic JavaScript so long as it is coming from a trusted source.
By trusted source I simply mean, we are hosting our API at www.myapi.com/some/stuff. So if the client calls the endpoint at that URL we are going to assume that it is a trusted api. Maybe that's bad to do? I don't know I am not a security expert.
Also, we are going to be serving everything over SSL.