Browser-based sign-in is an interactive authentication flow that happens inside a web browser, where the user types credentials, completes MFA, and receives a session token through the login page. Unlike API-only or non-interactive flows, the browser itself is part of the trust boundary because the page, scripts, and extensions can affect what the user sees and what code runs.
This matters in cyber security because the sign-in page is a high-value target for phishing, script injection, and browser-extension abuse. Attackers may try to alter form fields, capture credentials, redirect users, or tamper with the authentication experience at the moment access is granted. Defenders harden this surface with controls such as Content Security Policy, domain scoping, and careful validation of injected content. In practice, browser-based sign-in is where identity protection, web security, and endpoint control meet, so changes to page behavior can improve security but also break tools that rely on modifying the login flow at runtime.