Security / authentication laboratory
See where trust actually lives.
Operate a real BFF session, then inspect the protocols and custody boundaries that keep credentials out of browser JavaScript.
HTTPCOOKIECSRFRS256JWKS
02 / Observe
Interactive auth flow
CLIENTBrowserOpaque cookie
BOUNDARYBFFToken custody
AUTHORITYIdentityRS256 issuer
STATERedisServer-side session
- Ready. Choose an authentication action.
Browser-safe state
Opaque session
- Status
- UNAUTHENTICATED
- User
- —
- Expires
- —
- Scopes
- —
Browser holds
↕ credentials: includeOpaque HttpOnly cookie
intentionally unreadable by JavaScriptBFF / Redis holds
Access token · Refresh token · Metadata
never returned to this applicationEducational sample / never a live session token
JWT anatomy
A JWT is signed, not encrypted. Anyone holding it can decode its claims; RS256 protects integrity and issuer authenticity.
RS256 signature bytes
verified with matching JWKS kidPublic verification material
JSON Web Key Set
No keys fetched yet. This direct public-key request is separate from browser authentication.
Identity
private RSA keysigns JWT →Catalog
cached public JWKS→ verifies locally
private RSA keysigns JWT →Catalog
cached public JWKS→ verifies locally
Redacted client telemetry
Request timeline
Only requests made by this application. Passwords, cookies, authorization and full CSRF values are never recorded.
| Time | Method | Path | Status | Duration | Correlation |
|---|---|---|---|---|---|
| No requests yet. | |||||
Evidence, not assumptions
Security posture
Cookie session+CSRF token=Protected mutation