Concept
The Client Token Exposure Risk
Storing sensitive tokens (JWT access tokens, OAuth refresh tokens) directly in browser-accessible storage (like localStorage or sessionStorage) makes them vulnerable to Cross-Site Scripting (XSS) attacks. If an attacker succeeds in injecting a malicious script, they can read the tokens and steal the user's session.
The BFF Token Handler Pattern
The BFF Token Handler pattern solves this by moving token storage out of the browser entirely: