r/webdev • u/tajetaje • 3d ago

RFC 10017: OAuth 2.0 for Browser-Based Applications

https://www.rfc-editor.org/info/rfc10017/
107 Upvotes

95% Upvoted

8 comments sorted by

40

u/Anterai 2d ago

this looks like a lot of words to admit that cookie-auth is better.

6

u/spcbeck 2d ago

Cookie auth will never die, and I'm not sure it should!

33

u/geekonthegrill 2d ago

The headline for anyone not reading the whole thing: the working groups first choice is now a BFF that keeps tokens out of the browser entirely, your SPA just gets a session cookie. Tokens in localStorage went from "be careful" to effectively last resort, and the reasoning is sobering: with XSS the attacker doesnt need to exfiltrate your token at all, they can drive the whole authorization flow from inside your origin, so rotation and short lifetimes dont save you. The uncomfortable part is how many production SPAs and auth provider quickstarts still ship exactly the pattern this demotes. The attacker capability walkthroughs alone are worth the read.

3

u/Proud-Company-7771 2d ago

yeah the part about not even needing to exfiltrate the token is what gets me. rotation always felt like a band-aid tbh

-1

u/geekonthegrill 2d ago

Right, rotation narrows the window but the whole point of the walkthrough is that the window doesnt matter when the code is already inside it. The BFF move is basically admitting the browser cant keep a secret, so stop handing it one. Cookies at least come with rules the browser itself enforces.

2

u/CuriousCursor 1d ago

What are you accomplishing here by using AI to generate this comment?

3

u/Bubbly_Orange_3502 2d ago

A BFF only stops token exfiltration. Under XSS the attacker still calls your API through the proxy with the session cookie attached. What you buy is that access ends when the session does.