7 ms·
With an XSS exploit it is game over, you control the browser. Adding more complexity and opening up the possibility of CSRF exploits with BFF does not look lik
by evrflx 2y ago
With an XSS exploit it is game over, you control the browser.
Adding more complexity and opening up the possibility of CSRF exploits with BFF does not look like a good trade off to me.
- TobbenTM 2y agoYou don’t open up for CSRF attacks if you use same site cookies, which I guess is part of why this pattern is seeing more use now.