Research Demonstration

A Comparative Security Analysis of Authentication Architectures

This study examines three common patterns for handling authentication tokens in web applications — localStorage, HttpOnly cookies, and a Backend-for-Frontend proxy — evaluating each against key security criteria including token exposure, XSS susceptibility, and API surface visibility. The goal is to provide a structured, empirical comparison to inform architecture decisions in security-sensitive contexts.

Architecture A1 — Token in localStorage

Token storage: localStorage — visible to client-side JavaScript

Architecture A2 — Token in HttpOnly Cookie

Token storage: HttpOnly Cookie — hidden from JavaScript

Architecture A3 — Backend-for-Frontend with Redis

Token storage: Backend-for-Frontend with Redis — fully isolated from the browser

Attack Vectors

Potential attack methods targeting each authentication architecture