Securing SPAs and Blazor Applications using the BFF (Backend for Frontend) Pattern
summary
Claim: move OAuth tokens out of the browser into a server-side BFF to avoid XSS and broken iframe tricks; demo shows an ASP.NET Core BFF issuing same-site cookies, storing refresh tokens server-side, exposing simple /login /logout /user endpoints, and proxying API calls with YARP reverse proxy. Shows iframe silent-renew and check-session fail when browsers block third‑party cookies. Adds a static anti‑forgery header so cross‑origin calls trigger CORS preflight. Built token management library (Apache‑2) and the demos work.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 11:17Transmission of tokens over URLs
- 13:13Token storage in browsers
- 17:05How to get new access tokens
- 20:29JavaScript library
- 21:43Browser standardization
- 25:31Brave
- 26:57Browser Changes
- 28:24Browser Security
- 29:10Backend for Frontend
- 30:50Classic Server Side Model
- 31:34How does it work
- 32:43Full disclosure
- 34:00Do we expose login and log out
- 34:33OpenID Connect Authentication Handler
- 35:21User Endpoint
- 36:15Cookie Handler
- 41:05Session Change Notifications
- 43:02API
- 49:31Reverse Proxy
- 53:37Token Management Mode
- 54:37BFF Styles
related talks
57mSecuring SPAs and Blazor Applications using the BFF (Backend for Frontend) Pattern
01h 02mUsing the BFF pattern to secure SPA and Blazor Applications
01h 02mSecuring SPAs and Blazor Applications using the BFF (Backend for Frontend) Pattern
01h 00mBlazor Authentication? Hold My Beer!
27mMastering Secure Single Page Apps & APIs
01h 00mBreaking and securing OAuth 2.0 in frontends at NDC Security
01h 04mImplementing Authentication and Authorization with ASP.NET Core 2
57mBuilding Clients for OpenID Connect/OAuth 2-based Systems