Using the BFF pattern to secure SPA and Blazor Applications
summary
Argues that SPAs and Blazor must stop storing OAuth tokens in the browser and adopt a full BFF where ASP.NET Core + the OpenID Connect handler keep tokens server‑side, use sameSite cookies and session middleware, and proxy API calls (demo uses YARP reverse proxy and a token‑management library). Shows iframe silent‑renew already broken in Safari/Brave and warns against refresh tokens in the browser; the implemented BFF works in demos and preserves SSO and logout via back‑channel notifications.
AI-written summary · about
chapters (26)
- 0:00Start
- 2:19Agenda
- 3:03Back-End for Front-End Pattern
- 6:31Cross-Site Request Forgery
- 9:30Anti-Forgery Protection
- 12:20Why Would You Ever Write an Application with Javascript
- 12:56Implicit Flow
- 20:45Javascript Client Library
- 21:17The Browsers Are Changing
- 22:21Block Cookies in Iframes
- 27:07What an Origin Is and What a Site
- 27:48Sub Domain Takeover Attack
- 29:23New Ietf Recommendations
- 30:43Types of Javascript Applications
- 32:32Flavors of Bff
- 33:57The Full Bff Approach
- 37:21Authentication
- 38:10Javascript Sample
- 42:18Session Information
- 43:27Dynamically Suppress Sliding Cookies
- 43:53Token Management
- 47:24Session Change Notifications
- 51:41Course Check
- 51:53Preflight Request
- 53:27Remote Apis
- 55:17Reverse Proxy
related talks
01h 03mSecuring SPAs and Blazor Applications using the BFF (Backend for Frontend) Pattern
57mSecuring SPAs and Blazor Applications using the BFF (Backend for Frontend) Pattern
01h 02mSecuring SPAs and Blazor Applications using the BFF (Backend for Frontend) Pattern
01h 00mBlazor Authentication? Hold My Beer!
57mBuilding Clients for OpenID Connect/OAuth 2-based Systems
59mSecuring Web APIs from JavaScript/SPA Applications
27mMastering Secure Single Page Apps & APIs
01h 00mBreaking and securing OAuth 2.0 in frontends at NDC Security