You're Probably Doing Backend-for-Frontend (BFF) Wrong
The Backend for Frontend (BFF) pattern is crucial for securing modern applications, but it's widely misunderstood. In this video, we dive into the common pitfalls developers face when implementing BFFs. We break down why PKCE is not a replacement for a BFF, clarify the difference between a true BFF and a simple reverse proxy, and settle the debate on whether cookies are actually less secure than tokens. If you want to ensure your web apps are truly secure against XSS and token theft, this deep dive is for you. What You'll Learn: - Why PKCE protects authorization codes in transit, but doesn't secure token storage. - The critical distinction between a reverse proxy (token mediation) and a proper BFF. - The modern reality of HttpOnly cookies vs. localStorage tokens for XSS protection. - The security responsibilities you still have after implementing a BFF (like CSRF protection and session invalidation). - How to adopt the BFF pattern incrementally without rewriting your entire application. Resources: Auth0 Blog Post: Things Developers Get Wrong About the Backend for Frontend Pattern - https://auth0.com/blog/things-developers-get-wrong-about-the-backend-for-frontend-pattern/ Timestamps: 0:00 - Introduction: The BFF Misconceptions 1:15 - Why PKCE Isn't a Replacement for BFF 3:30 - BFF Is Not Just a Proxy (Token Mediation vs. BFF) 5:45 - The Truth About Cookies vs. Tokens (XSS & CSRF) 8:10 - What BFF Doesn't Solve (CSRF, Session Invalidation) 10:20 - How to Adopt BFF Incrementally 12:00 - Threat Modeling: Do You Need a BFF? If you enjoy this content and want to learn more about identity, security, and access management, subscribe to our channel! Have a topic you'd like to see covered? Let us know if the comments below 👀 ___________________________________________ 🔵Try Auth0 for free - https://a0.to/auth0 🔵The Auth0 blog - https://a0.to/blog 🔵Ask questions on the Community Forum - https://a0.to/community ___________________________________________ Follow Us on Social 🔵 X / Twitter - https://a0.to/twitter 🔵LinkedIn - https://a0.to/linkedin