BFF proxy security contracts

A frontend-owned server route is still a server trust boundary. The dangerous shape is a thin relay that lets the browser choose a destination, method, headers, or business action and assumes the upstream will reject anything unintended. Treat each proxy route as a small capability, not as a transparent tunnel.

Boundary with sibling skills

• Use frontend-security-baseline for browser XSS, CSP, token storage, cookies, CSRF, redirects, and client-bundled secrets.
• Use frontend-auth-flow-contracts for login/signup/callback/passkey UI behavior.
• Use file-ingest-contracts for drag/drop, picker, paste, accept/file.type, and preview URL lifecycle in the browser.
• Use this skill for frontend-owned server routes that build or relay upstream HTTP requests, including upload-specific or WebView-specific gateway endpoints.
• This does not replace upstream object authorization, persistent replay/idempotency, authoritative metering of business value (elapsed time, credits, usage), or a full backend threat model.