BFF Pattern Explained: Why API Tokens Belong on the Server, Not the Browser

·1 views

Placing API access tokens directly in browser-side JavaScript exposes them to any third-party script, XSS vulnerabilities, and anyone inspecting network traffic via developer tools. The Backend-for-Frontend (BFF) pattern addresses this by routing all browser requests through a Next.js server layer, which communicates with the API privately and keeps tokens out of the client entirely. With Next.js App Router, Server Actions and Route Handlers run server-side, allowing session cookies to remain HttpOnly and eliminating cross-origin CORS complexity. The approach also removes the API's URL and authentication structure from public view, reducing the attack surface available to potential bad actors. While the pattern is well-established, implementing it consistently requires handling cookie forwarding, content-type logic, and error management — boilerplate that most projects end up rewriting from scratch.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How the Internet Nearly Broke Between 2000 and 2002

Between 2000 and 2002, the global internet experienced a period of deep structural instability that went largely unnoticed by the public. The TCP/IP protocol stack, originally designed for a small network of academic nodes, had grown too large and complex to be safely updated or modified. The Border Gateway Protocol (BGP), responsible for managing global routing, struggled with rapidly expanding routing tables that pushed hardware to its limits, causing widespread connectivity disruptions. Engineers at major network hubs in cities like Frankfurt and London observed 'route flapping,' an unstable oscillation in routing data that triggered localized network collapses. This era, described as the Millennium Fracture, revealed that the internet's foundational architecture was ossifying under the weight of its own explosive growth.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Visualize NPU Latency Stages for Better Android AI Performance

Developers optimizing AI models for Android often focus solely on inference time, but real-world latency involves four distinct stages: CPU preparation, memory transfer, NPU computation, and output retrieval. The Neural Processing Unit is a domain-specific chip built for tensor operations, and a key bottleneck is moving data between system RAM and the NPU's local high-speed memory rather than raw compute speed. Google's AICore platform shifts model ownership from individual apps to the Android OS, reducing binary bloat and improving hardware scheduling. Using modern Kotlin and Jetpack Compose, developers can build visualization tools that break down each latency phase to pinpoint performance issues. Identifying whether slowdowns stem from memory bandwidth or compute constraints allows for more targeted and effective optimization.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Platform Engineering Builds Internal Tools to Help Dev Teams Ship Faster at Scale

As organizations adopt cloud-native technologies, infrastructure teams are evolving beyond traditional DevOps practices toward Platform Engineering. While DevOps focuses on collaboration, automation, and delivery, Platform Engineering goes further by creating internal platforms with reusable building blocks. These platforms abstract repetitive infrastructure tasks, allowing developers to focus on business logic rather than rebuilding deployment pipelines or monitoring stacks from scratch. A core principle is self-service infrastructure, enabling developers to provision environments and deploy applications without depending on platform teams. The goal is not to hide complexity but to manage it, helping organizations deliver software faster while maintaining consistency and reliability.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Six-Part Guide Shows How to Auto-Sync YouTube Playlists to Spotify with Python

A developer on DEV Community has published a six-chapter tutorial series teaching readers how to build a Python script that automatically syncs a YouTube playlist to Spotify on a daily schedule. The series covers everything from setting up API accounts for both platforms to writing the core code files and deploying the finished script. No prior programming experience is required, as each line of code is explained in plain English throughout the chapters. The full source code for the project is publicly available on GitHub at github.com/Towernter/youtube-to-spotify. Readers are advised to follow the chapters in order, as each one picks up exactly where the previous left off.

0 comments Read more at DEV Community