Frozen document. Dates and status refer to its original source. Private resources and unreviewed images are unavailable.

status: accepted

Use Keycloak-backed BFF sessions

The owner selected the BFF stack and its recommended server-side browser session model for the first Atlas prototype. This supersedes the direct browser-token design in ADR 0006. Keycloak remains the identity provider with password plus TOTP and the accepted sensitive-action assurance policy.

[Private setup detail omitted.]

Retain the accepted five-minute access token, 15-minute idle and eight-hour absolute session limits, plus fresh MFA within five minutes for sensitive actions. The BFF session must not extend an expired Keycloak session. Require a session-bound CSRF token and origin checks for state-changing requests. SameSite alone is insufficient. Exact callback and cookie behavior need validation through both the local HTTPS gateway and the hosted UI route selected in ADR 0010.

The BFF authenticates and projects authorized data, while business record owners still check current customer/employer membership, task assignment, action permission, revision and sensitive-action assurance. Never turn a BFF machine credential or caller-supplied identity header into business authority. HTTP-only cookies limit token extraction through script injection but do not prevent malicious same-origin requests; CSRF and browser security tests remain necessary.

The existing security contract retains document quarantine, scanning, audit redaction, bilingual authentication and controlled recovery. Its browser-token mechanics are amended by this ADR. Validation must cover fixation, CSRF, refresh races, logout, step-up, cross-employer denial and token absence from browser storage.