blog: architecture driven auth part 3 (BBOC) #3967
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Edit: Browser-Based OAuth Client: The architecture you shouldn't be u…
kmaida
reviewed
Jan 5, 2026
Contributor
kmaida
left a comment
kmaida
left a comment
There was a problem hiding this comment.
I'm no longer a CODEOWNER, so someone from FusionAuth DevRel will need to approve final changes.
astro/src/content/blog/browser-based-oauth-client-security-architecture.mdx
Outdated
Show resolved
Hide resolved
astro/src/content/blog/browser-based-oauth-client-security-architecture.mdx
Outdated
Show resolved
Hide resolved
|
|
||
| - Cannot use client secrets in token exchange requests. | ||
| - Must rely entirely on PKCE (Proof Key for Code Exchange) for request validation. | ||
| - Cannot authenticate to the authorization server in the traditional sense. |
Contributor
There was a problem hiding this comment.
I'm not really sure what's meant by this. It's true, but it's not really explained enough to make sense here as a list item.
astro/src/content/blog/browser-based-oauth-client-security-architecture.mdx
Outdated
Show resolved
Hide resolved
astro/src/content/blog/browser-based-oauth-client-security-architecture.mdx
Outdated
Show resolved
Hide resolved
astro/src/content/blog/browser-based-oauth-client-security-architecture.mdx
Outdated
Show resolved
Hide resolved
|
|
||
| ### Migration to TMB | ||
|
|
||
| Backend endpoints handle OAuth flows using PKCE and store refresh tokens in server-side sessions while returning short-lived access tokens to the frontend. The frontend implements in-memory token storage with automatic refresh logic that calls the backend token endpoint when tokens near expiration. With TMB, much of the frontend OAuth logic remains similar to BBOC, and the migration focuses on moving token exchange and storage to the backend. The frontend remains complex due to direct API calls requiring access token management. |
Contributor
There was a problem hiding this comment.
Add a link to the TMB article?
astro/src/content/blog/browser-based-oauth-client-security-architecture.mdx
Outdated
Show resolved
Hide resolved
| - **Content Security Policy (CSP):** Implement strong, nonce-based CSP to block XSS attacks and restrict script execution. | ||
| - **Subresource Integrity (SRI):** Use SRI for all third-party scripts to prevent supply chain attacks from compromising your application. | ||
| - **Rate limiting:** Apply aggressive rate limiting on authentication endpoints to slow brute force and token theft attempts. | ||
| - **Demonstrating Proof of Possession (DPoP):** Implement DPoP to bind tokens to specific clients, preventing token replay by attackers. |
Contributor
There was a problem hiding this comment.
...and/or mTLS. I know that's a whole nother topic, but I don't think it needs to be fully explained here. A mention and link to learn more would suffice.
astro/src/content/blog/browser-based-oauth-client-security-architecture.mdx
Outdated
Show resolved
Hide resolved
Co-authored-by: Kim Maida <yi.mihi@gmail.com>
Draft feedback bboc
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.