Mastering Secure Single Page Apps & APIs
summary
Claims a practical pattern that replaces in-browser tokens with a backend cookie layer so SPAs keep front-end simplicity while gaining website-grade security. Implements a small REST oauth agent that issues sameSite=strict cookies carrying opaque access tokens, an API Gateway plugin that decrypts and introspects them, then forwards a JWT to backend APIs. Shows a working React demo and GitHub repo from Curity, describes CDN and dev-server deployments, supports micro‑UIs, and warns this does not eliminate XSS risks.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:25Agenda
- 3:25Browser Cookies
- 5:05Token Handler Pattern
- 8:24Whats an Oath Agent
- 9:04Login Flow
- 10:46Cookie Details
- 11:42Cookie Example
- 13:06API Gateway
- 15:10Security
- 17:53Deployment
- 22:36Demo
related talks
59mSecuring Web APIs from JavaScript/SPA Applications
30mSingle Page Applications: Is your design secure?
26mSecuring Single Page Applications with Token Based Authentication
32mSecurity-First Web Apps
01h 03mSecuring SPAs and Blazor Applications using the BFF (Backend for Frontend) Pattern
57mSecuring SPAs and Blazor Applications using the BFF (Backend for Frontend) Pattern
44mMicro Frontends and Security
57mThe insecurity of OAuth 2.0 in frontends