This is pretty close to Moving Target Defense (MTD) and Binary Diversification.

TIL! Close, just taken up a notch that wasn't feasible before where MTD was more configuration focused. As CPUs are to FPGAs, MTD would be to this. Rather than telling the config to change on the fly, the code changes on they fly. And rather than having multiple Binaries prepared, the pipeline of changing binaries are more just-in-time than batched.

Still waiting for "BFF" https://datatracker.ietf.org/doc/html/draft-bertocci-oauth2-... to gain popularity, the setup seems solid tho slightly more complex compared to these other methods.

BFF is not great for long term security, notably token binding. It's hard enough to bind an artifact to the browser session from the IDP - having each app implement binding passthrough from browser to app to IDP is even worse.

Doesn't this also mean you have to actually have a back end for your site? Can't just host an spa on static web hosting on a cdn.