The browser OAuth baseline just changed: RFC 10017 makes BFF architecture a first-class security decision

Browser-based OAuth applications face a simple architectural question: which credentials must ever be exposed to browser JavaScript? Modern guidance increasingly favors patterns that reduce token exposure in the browser.

A backend-for-frontend can terminate OAuth flows server-side, hold sensitive tokens in a controlled backend and expose only the application session needed by the browser.

For AppKit and Outborn Account, browser auth should make this choice explicit per application and environment, with secure defaults, rotation, revocation and observable session boundaries.

RFC 10017, published August 2026, documents three browser OAuth patterns: backend-for-frontend, token-mediating backend and browser-based client. A BFF can keep access and refresh tokens out of JavaScript, but must still defend cookies, CSRF, backend routing and session lifetime.

Compare a pure SPA and a BFF login under a malicious third-party script. Assess exposed tokens, reachable APIs, anti-CSRF protection and host allowlisting instead of claiming a BFF solves every browser risk.

Explanatory conceptual flow. Test assumptions against the actual legal, product and technical environment.

Document the chosen threat model, credential storage, secure cookie attributes, PKCE use and allowed resource servers.

Primary source: Official documentation. This added analysis is not an independent compliance certification or performance benchmark.