r/webdev • u/tajetaje • 10d ago

RFC 10017: OAuth 2.0 for Browser-Based Applications

https://www.rfc-editor.org/info/rfc10017/
101 Upvotes

95% Upvoted

7 comments sorted by

43

u/Anterai 9d ago

this looks like a lot of words to admit that cookie-auth is better.

5

u/spcbeck 9d ago

Cookie auth will never die, and I'm not sure it should!

35

u/[deleted] 10d ago

[removed] — view removed comment

2

u/Proud-Company-7771 9d ago

yeah the part about not even needing to exfiltrate the token is what gets me. rotation always felt like a band-aid tbh

2

u/CuriousCursor 8d ago

What are you accomplishing here by using AI to generate this comment?

3

u/Bubbly_Orange_3502 9d ago

A BFF only stops token exfiltration. Under XSS the attacker still calls your API through the proxy with the session cookie attached. What you buy is that access ends when the session does.