xss, csrf (+다른 탈취 기법)등으로 토큰 탈취를 원천적으로 막을만한 표준화된 방법이 충분하지 않아서

(즉 http only 쿠키 같은거 걸어놔도 뚫을 방법은 얼마든지 충분히 많아서)


bff를 두던가 해서 jwt토큰을 클라이언트에 안보내는 방향으로 가는게 맞나


아래글들 보니까 대충 그런식으로 하라는것 같은디



https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps-25

OAuth 2.0 for Browser-Based ApplicationsThis specification details the threats, attack consequences, security considerations and best practices that must be taken into account when developing browser-based applications that use OAuth 2.0. Discussion Venues This note is to be removed before publishing as an RFC. Discussion of this document takes place on the Web Authorization Protocol Working Group mailing list (oauth@ietf.org), which is archived at https://mailarchive.ietf.org/arch/browse/oauth/. Source for this draft and an issue tracker can be found at https://github.com/oauth-wg/oauth-browser-based-apps.datatracker.ietf.org



https://datatracker.ietf.org/doc/rfc9700/

RFC 9700: Best Current Practice for OAuth 2.0 SecurityThis document describes best current security practice for OAuth 2.0. It updates and extends the threat model and security advice given in RFCs 6749, 6750, and 6819 to incorporate practical experiences gathered since OAuth 2.0 was published and covers new threats relevant due to the broader application of OAuth 2.0. Further, it deprecates some modes of operation that are deemed less secure or even insecure.datatracker.ietf.org