The more users you get, the better, right? Well, this is not always true. You certainly want to keep bots and fraudulent users out of your app. It's a common practice to add a second factor and send a verification code. However, there's a new villain in town and 2FactorAuthentication has to evolve to keep up. Done incorrectly, this can hurt your customer onboarding experience and be a costly mistake. Join this session to discuss the trade-off between security and user experience and learn how to build a secure onboarding experience that won't be a pain to your users.

Single Page Applications appear simple at first sight. Web developers provide a superb user experience, and it is also relatively easy to implement token-based security in the browser. Yet this is against current best practices for browser-based apps, and security concerns can become a blocking issue. It is instead recommended to implement a Backend for Frontend (BFF), to reduce browser threats. Yet this often results in the adoption of website technologies to issue secure cookies, which can work against other web architecture goals. In this talk, I will show how a separation of web and API concerns can give you the best choices. In the talk, I will present the Token Handler Pattern — Curity's variation of the Backend For Frontend approach. I will show the open-source projects we created that facilitate the implementation of the pattern.

The talk will cover modern methods such as passkeys, TOTP, and biometrics, along with more advanced patterns like offline authentication for mobile apps. Attendees will learn how to implement these strategies leveraging React Native primitives while understanding the security trade-offs and best practices.