METHRAX

METHRAX / ENGINEERING

From PKCE to
Backend-for-Frontend

A practical architectural look at moving browser authentication behind a server-managed security boundary.

METHRAX ENGINEERING · SECURITY · ASP.NET CORE

Why BFF?

Modern browser applications often need to work with OAuth and OpenID Connect while minimizing the amount of sensitive credential material exposed to browser JavaScript. The Backend-for-Frontend pattern introduces a server-side boundary that owns the authentication session and token handling.

From PKCE to a server-managed session

PKCE strengthens the authorization-code flow, but a BFF changes the browser's relationship with tokens entirely. Instead of persisting access tokens in the frontend, the browser can interact with the BFF using a secure HttpOnly session cookie.

Browser → BFF → Identity Provider
Browser ← Secure Session Cookie
BFF → API using server-held token

What this changes

  • The frontend becomes less responsible for OAuth token lifecycle management.
  • Token handling is concentrated in a trusted server environment.
  • Session, CSRF, cookie and proxy configuration become important parts of the security model.
This starter article is intentionally short. Replace it with the complete Methrax Engineering article when ready.