Book 3 · Lesson 3.11 · deep-dive

Deep-dive — when you need a BFF

Contrast Express BFF with Rust gateway proxy
Name maverick-ui problems a BFF solves
Defend Team Radar no-BFF decision

Prerequisites: 3.2 · 0.7

Optional 60-minute rabbit hole — not on the Team Radar ship path.

Two architectures

Toggle BffProxyFlow:

	maverick-ui BFF	millipede gateway
Session	Cookie + CSRF	Bearer JWT
OAuth tokens	Hidden in BFF	N/A in olab
Aggregation	Multi-upstream compose	Thin reverse proxy
Stack	Express + React	Axum + SolidJS

When you need a BFF

Enterprise OAuth with refresh token vault
CSRF-protected cookie sessions
Heavy response aggregation for one UI

When gateway is enough

JWT at edge + mTLS mesh
Browser calls /api directly (same-origin proxy in dev)
No hidden third-party API surface

See docs/work-alignment.md — reference only.

Teach-back prompt

Write two sentences for an EM audience: why Snyk uses BFF and olab does not.

BFF vs gateway reading

Toggle BffProxyFlow — compare paths.
Skim docs/work-alignment.md BFF section.
Write when you would add BFF to Team Radar (if ever).

Lesson 3.11 check

1. Team Radar ships… Express BFF Rust gateway proxy MobX BFF Cerberus