2 docs tagged with "OAuth2"

The security motivation, structure, and threat model (token theft vs. session riding) of the Backend for Frontend (BFF) pattern, which eliminates token exposure in SPAs

Sender-constrained tokens (DPoP, mTLS) that mitigate Bearer-token replay, and refresh-token rotation. Protection for public clients such as mobile apps