IFOS Data Gateway

Auth.js on the server, tokens in an encrypted httpOnly cookie, rotating refresh tokens, a hardened BFF proxy, request cancellation end to end, and strict security headers.