Identity at the edge, Handled.

Secure frontend identity is complex

Identity in the browser is crucial in enabling your users to securely use your services. The browser is a hostile environment and many distinct decisions have to be made which have significant implications on security and user experience.

• What does a session look like in the browser?

  • A session identifier referencing something in the backend?
  • A full tokenset consisting of Identity, Access and Refresh token?
  • Is this tokenset stored in plaintext or encrypted?

• Where is the session stored?

  • LocalStorage, SessionStorage, Cookies?
  • If you use cookies, which cookie attributes should be used?

• How do you refresh the session?

  • Can you handle concurrent requests during a refresh?
  • Does the session match the access token or refresh token lifetime?
  • Should you proactively refresh the tokenset?

• Should you use a public OAuth client?

  • Which OAuth flow should you use?
  • What if a refresh token is compromised?
  • Are you implementing PKCE?

• Does each frontend handle its own session?

  • How can you keep each frontend consistent and in sync?
  • Should you publishing an internal library to use?
  • What if you need to update this library?

• What are the performance and security implications of each of these decisions?

  • Do these effectively mitigate Cross Site Scripting (XSS)?
  • What about Cross Site Request Forgery (CSRF) attacks?

Handled Cloud handles identity once, at the edge, in one place, so your users get one consistent experience and your teams build features instead of identity plumbing.

Identity behaviours for your front ends

Your front ends manage the session through one consistent set of endpoints, rather than each app integrating directly with your identity provider. Login, logout, refresh, and expiry are served on your domain; there is no OAuth client code in any frontend.

• Login, logout, refresh, and expiry endpoints on your domain
• Expiry warning injected into your pages, with a countdown and a configurable on-expiry action
• The session follows the user between micro-frontends; no per-app identity code
• Lightning fast - Session validated at the edge before the frontend bundle loads

Enterprise requirements, handled.

A single Handled Cloud deployment handles identity for every origin in your configuration: micro-frontends, API gateways, backend services. Add a new app by adding a route.

• Federated SSO with your existing IdP
• Data plane in your own Cloudflare account; token-store residency options of European Union, United States, or FedRAMP-compliant US
• EU-resident control plane
• Independent environments for development, staging, and production
• Change management: edit, test, and publish after review