I've been working on doing client-side only applications for a while. And the way I used to connect to an API (that I have control over) was to make a basic authentication using login/password and to create a JWT token on the server, save it in an HttpOnly + Secure cookie, and send it back to the client application when the flow has succeeded.

Today, I have to work on an application that handles parts of the computation on the server and where I process my form on the backend (looks a bit like PHP). The flow is the following:

• I enter my credential in the browser and I submit the form
• I get my data and make some validations in the server part of the frontend application
• Then, I make a query to my remote API and ask for authenticating the user, I get a cookie back — on the server.

My questions are:

• is it safe to forward the cookie to the client through my intermediate layer?
• does it exist a better way to manage authentication when an intermediate server is implied (even if the server is part of the frontend)

Thanks for your help