The BFF Pattern: Your API Token Has No Business in the Browser

Short summary

The article explains why exposing API tokens in browser-side JavaScript is a security liability and advocates the Backend-for-Frontend pattern where the browser only talks to your Next.js server, which proxies to your API. It walks through the boilerplate cost of doing this by hand—cookie forwarding, content-type negotiation, retry handling—and introduces @lepresk/next-bff-fetch, a server-only fetch client that encapsulates that plumbing. The approach eliminates CORS entirely and keeps tokens off the client.

• •Browser-side API tokens are readable by any JS on the page including analytics and XSS vectors
• •BFF pattern routes all API calls through Next.js server, eliminating CORS and token exposure
• •Author released @lepresk/next-bff-fetch to handle cookie forwarding, content negotiation, and error handling

Generated with AI, which can make mistakes.