In sharepoint 2010/2013, I know REST api is automatically security trimmed, but is the JSOM (javascript object model) also security trimmed?
2 Answers
Yes, they are both security trimmed, there is no impersonation or elevation of privilege available in these APIs.
JSOM (and REST API) runs in the context of the user querying the endpoint or execute the code on the client side. Therefore it is security trimmed.