Frontend Authentication

Representing identity, sending credentials safely, surviving session expiry and rendering authorization-aware UI — while the backend stays the only authority.

What the Frontend Is Responsible For in Auth

Four jobs — represent identity, send credentials safely, survive expiry, render authorization-aware UI — and one job that is never yours: enforcement.

Q · If the server is the only thing that can enforce anything, what is the frontend actually responsible for in authentication?
Cookies vs Script-Readable Tokens

A genuine trade-off with no universal winner: unreadable-but-automatic against readable-but-explicit, and the attributes that decide what each one actually costs you.

Q · Where should a credential live in the browser, and what does each choice give an attacker who gets a foothold?
Session Expiry and the Refresh Race

What the interface does when the credential dies mid-session: silent refresh, five simultaneous 401s that must produce one refresh, and the difference between expired and revoked.

Q · The credential stops working while the user is halfway through something — what should the interface do, and what must it not do five times at once?
Authorization-Aware UI

Render what the user can actually do, so the interface is honest — then let the server refuse the request anyway, and stop leaking the existence of what they cannot see.

Q · How do I show each user an interface that matches their permissions, without ever mistaking that for permission?
Auth Across Tabs

One session, several documents, no shared memory: logging out in one tab has to reach the others, and the tab that missed the message is still rendering a logged-in UI.

Q · The user has five tabs open and logs out in one of them — what happens in the other four, and what should?
Login Redirects and the Open-Redirect Trap

Send the user back to what they were trying to reach — and never redirect to a URL somebody handed you in a query parameter.

Q · How do I return a user to where they were going after logging in, without turning my login page into a redirector for anywhere on the internet?