What we have: - Frontend does PKCE code exchange directly with Zitadel - Tokens land in sessionStorage (JS-accessible → XSS can steal them) - Frontend sends Authorization: Bearer header - Token refresh is client-side - Idle detection is client-side hack
What BFF pattern gives: - Backend does code exchange → tokens never touch browser - Backend stores tokens in Valkey → session ID in httpOnly cookie - Frontend sends cookie automatically (no JS involvement) - Token refresh server-side → no automaticSilentRenew needed - Session sliding is a backend concern → heartbeat endpoint - XSS can't steal tokens (httpOnly = invisible to JS)
I let claude audit my current flow and thats what I got. Should I change to the backend for frontend flow? Currently I have the PKCE code exchange through my backend with rate limiting etc. but claude says thats not that good.. Any opinion on that?
Continue the conversation
Join the Discord to ask follow-up questions and connect with the community
Z
ZITADEL
ZITADEL - Identity infrastructure, simplified for you.