The Backend for Frontend (BFF) pattern is crucial for securing modern applications, but it's widely misunderstood. In this video, we dive into the common pitfalls developers face when implementing BFFs. We break down why PKCE is not a replacement for a BFF, clarify the difference between a true BFF and a simple reverse proxy, and settle the debate on whether cookies are actually less secure than tokens. If you want to ensure your web apps are truly secure against XSS and token theft, this deep dive is for you.
What You'll Learn
- Why PKCE protects authorization codes in transit, but doesn't secure token storage.
- The critical distinction between a reverse proxy (token mediation) and a proper BFF.
- The modern reality of HttpOnly cookies vs. localStorage tokens for XSS protection.
- The security responsibilities you still have after implementing a BFF (like CSRF protection and session invalidation).
- How to adopt the BFF pattern incrementally without rewriting your entire application.
Resources
- Auth0 Blog Post: Things Developers Get Wrong About the Backend for Frontend Pattern
- Checkout the Confused Developer Playlist for more videos like this.
Top comments (0)