I have a web application that needs to use scraping, and I need to decide between 3 different architectures on how the scraping will be divided between the backend and frontend.

My web application uses a NodeJS backend (with Express) and a React frontend. My goal is to analyze/scrape some HTML from an external website (we'll call it fakewebsite.com), probably with a package like Cheerio.

Here is the general flow that my application needs:

1. User specifies a url from fakewebsite.com (ex. fakewebsite.com/post/12345) on my front end website

2. That page is analyzed and specific fields are scraped from its HTML, eventually being given to backend to perform further backend logic

I can think of 3 possible configurations to achieve this goal. I need to decide which one is the best to move forward with.

• Method A: All Front-end

  1. When the user specifies the URL, the client-side front-end does a request for the HTML file from the URL
  2. The front end analyzes the HTML response with cheerio, getting the data it needs
  3. The front end sends a request to the backend with the exact data the backend requires

  This seems nice, but would expose some business logic (not critical logic, but also not ideal) to front end users.

• Method B: All back-end

  1. The front end sends a request to the back end with the URL
  2. The back end loads the HTML from the URL and scrapes the fields it requires
  3. The back end continues performing additional logic

  I feel like this option would not scale because fakewebsite.com would block my backend from performing requests after a while

• Method C: Mix of front end and backend

  1. The client-side front end fetches the HTML from fakewebsite.com using the URL
  2. The front end sends this HTML to the backend via a POST request
  3. The backend scrapes this HTML and then continues performing additional logic

  I like this option the best. But, I am hesitant about security flaws with this approach, since in theory a malicious user could use the post endpoint with some HTML designed to inject malicious code into my Node server.

Are my concerns about security flaws in Method C (uploading HTML to Express) justified? Do you have any recommendations on the best way to proceed with architecting this scraping problem?