Skip to main content

Principles

  • Do not expose backend endpoints in frontend code
  • Use SSR/edge routes to forward authenticated calls
  • Keep secrets in server-only env vars

Server-Side Proxy Example

WebSocket Proxy Notes

  • Terminate WS at the server and relay authorized events to clients
  • Avoid direct browser → backend WS when auth/secrets are involved