Single Page Applications appear simple at first sight. Web developers provide a superb user experience, and it is also relatively easy to implement token-based security in the browser. Yet this is against current best practices for browser-based apps, and security concerns can become a blocking issue. It is instead recommended to implement a Backend for Frontend (BFF), to reduce browser threats. Yet this often results in the adoption of website technologies to issue secure cookies, which can work against other web architecture goals. In this talk, I will show how a separation of web and API concerns can give you the best choices. In the talk, I will present the Token Handler Pattern — Curity's variation of the Backend For Frontend approach. I will show the open-source projects we created that facilitate the implementation of the pattern.

In a period where the digital landscape is constantly evolving, the way we understand and interact with the web & internet is undergoing a profound transformation.

The web democratised how we connect with each other and how we exchange information. This talk takes a guided approach to introduce some of the concepts that could shape how we developers build for the web in the near future.

Looking into open standards that take into consideration the user’s data, identity and trust.

The talk will cover modern methods such as passkeys, TOTP, and biometrics, along with more advanced patterns like offline authentication for mobile apps. Attendees will learn how to implement these strategies leveraging React Native primitives while understanding the security trade-offs and best practices.

Devalue is the client-server serialization library used by SvelteKit. In this talk, I will go over why we want serialization libraries, the what and why of devalue, and the current limitations of devalue and other solutions.