Securing SPAs and Blazor Applications using the BFF (Backend for Frontend) Pattern
summary
Charts the shift from implicit tokens to a server-side BFF and shows a working ASP.NET Core prototype that stores only an httpOnly cookie front-to-back, manages refresh tokens server-side, and reverse-proxies API calls with YARP. Explains why browser changes (Safari cookie blocking, Chrome “cookie pocalypse” planned 2023) break iframe renew and session checks, why XSS and CSRF force moving token logic off the client, and why same-site cookies plus a static custom header and ASP.NET Core session/token plumbing deliver a practical secure SPA/Blazor pattern.
AI-written summary · about
chapters (19)
- 0:00Start
- 3:39Setting the scene
- 4:47Modern Business Applications
- 8:17Threat: cross-site request forgery (CSRF)
- 11:27CSRF mitigation with anti-forgery tokens
- 14:34History 2 - The Token Era
- 15:41OAuth 2 Approach Implicit Flow
- 16:10Challenge: Token Transmission
- 17:06Authorization Code Flow
- 17:53Challenge: Token Storage
- 22:09Challenge: Token and Session Management
- 25:08JavaScript Client Libraries
- 30:11Browser Changes (3)
- 33:50New IETF Recommendations
- 37:50Full BFF Overview
- 38:30Building a BFF with ASP.NET Core
- 41:11Building Blocks (1)
- 41:42User authentication and token requests
- 55:06Summary
related talks
01h 03mSecuring SPAs and Blazor Applications using the BFF (Backend for Frontend) Pattern
01h 02mUsing the BFF pattern to secure SPA and Blazor Applications
01h 02mSecuring SPAs and Blazor Applications using the BFF (Backend for Frontend) Pattern
01h 00mBlazor Authentication? Hold My Beer!
27mMastering Secure Single Page Apps & APIs
01h 03mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
53mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
39mA guided tour of ASP.NET core security