35:14This recording is not available yet.
How to Design Single Page Apps with a BFF to make API calls Securely and Prevent Token Hijacking
Download resourcesAbout this session
Paul Figura, Chief Architect at Indigo Consulting and a long-time identity and access management practitioner, explains why naive single-page apps that store OAuth access tokens in browser cookies are vulnerable: an XSS-injected script can read the cookie and replay the token against any API trusting the same issuer, scopes and audience, common because teams copy each other's configurations. He introduces the backend-for-frontend (BFF) pattern, first coined at SoundCloud in 2015, where the SPA never receives the raw access token; instead the BFF completes the OAuth authorization-code flow, encrypts the token into an opaque cookie or maps it to a session ID, and decrypts it only when forwarding calls to the real API. A live ForgeRock Identity Gateway demo shows a hijacked token failing against protected and admin-only APIs once the BFF is in place, while a public API stays reachable. He closes with hardening measures such as OAuth scopes, avoiding shared audiences and volatile-memory-only token storage, and notes a BFF alone does not stop an XSS script from replaying stolen BFF cookies, a gap the unratified DPoP specification aims to close.
Key takeaways
- Never store a raw OAuth access token in a browser cookie or local storage for a single-page app; an XSS-injected script can read and replay it against any trusting API.
- Put a backend-for-frontend (BFF) between the SPA and your APIs: have it complete the OAuth authorization-code flow and hand the browser an encrypted or opaque token instead of the real one.
- Always validate tokens on the API side too (issuer, expiry, audience, scopes); a BFF does not remove that requirement, and a hijacked BFF cookie can still be replayed through the BFF itself.
- Avoid sharing the same OAuth scopes and audience across unrelated APIs; copying another team's access-manager configuration is how one leaked token ends up granting access to admin-only endpoints.
- Track the DPoP specification (not yet ratified) as the longer-term fix for BFF cookies being replayed by the same malicious script that stole them.
Speakers
Paul Figura
Hello
