Web Security · Senior · Question 29 of 75

What is the backend-for-frontend (BFF) pattern for SPA authentication?

✓Correct answer: A server-side component handles OAuth, keeps tokens, and gives the browser only an HttpOnly session cookie
2Storing tokens in the backend's logs for debugging
3A second SPA that shows the login page

Explanation

Tokens never reach JavaScript, so XSS can't steal them. The BFF proxies API calls and adds the access token on the server side.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.