Overview
RFC 10017 frames browser OAuth token storage as an architecture decision about authority: which component is the OAuth client, which holds long-lived refresh authority, and which makes protected resource requests. The series moves from malicious same-origin JavaScript and fresh-token attacks to the stronger Backend for Frontend boundary, then weighs token mediation and browser-only storage. It concludes conditionally: prefer a server-side-session BFF when proxying is acceptable, keep refresh authority server-side when direct calls are required, and treat a browser-only client as a public client with bounded residual exposure. PKCE, CSRF, exact redirects, CORS, least authority, and replay controls reduce specific failure paths but cannot make a compromised public origin confidential. When a first-party frontend and API share a domain, a server-side session may avoid an unnecessary OAuth relationship.
Learning outcomes
- Token storage is subordinate to the authority boundary: decide who holds credentials and makes protected requests.
- A server-side-session BFF keeps OAuth tokens and resource requests behind the server when proxying is acceptable.
- Token mediation protects refresh authority but exposes access-token use to the browser and its same-origin attacker.
- PKCE, CSRF, exact redirects, CORS, least authority, and replay controls limit specific paths; none makes a public origin confidential.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
Why is browser OAuth token storage an architecture decision?
Because storage cannot decide which component is the OAuth client or which component makes protected requests. RFC 10017 treats those authority relationships as the primary design choice.
What does a BFF protect in browser OAuth?
A BFF keeps OAuth token operations behind a server and, with server-side sessions, keeps access and refresh tokens out of frontend JavaScript. It still requires CSRF defenses and bounded outbound routes because compromised browser code can hijack permitted actions.
When is token mediation preferable to a BFF?
Token mediation is appropriate when direct browser-to-resource-server calls are a genuine system requirement and access-token exposure is acceptable. It keeps refresh authority server-side but returns access authority to the browser.
Can browser storage make a public OAuth client confidential?
No. Storage can reduce selected exposure, such as isolating a refresh token or avoiding persistence, but same-origin malicious code can still start a fresh flow or exercise authority the application permits.