duende-bff

Manage server-side sessions, tokens, and CSRF enforcement for SPA backends.

10|2|Updated Mar 16, 2026

Search Tags:#dotnet #bff #csrf #aspnet-core #token-management #openid-connect #spa-security

Ready to run

npx skills add https://github.com/DuendeSoftware/duende-skills --skill duende-bff

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: duende-bff
Source: https://github.com/DuendeSoftware/duende-skills/tree/main/skills/duende-bff
Command: npx skills add https://github.com/DuendeSoftware/duende-skills --skill duende-bff

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Secures single-page applications by moving OAuth tokens and sensitive data server-side, enforcing CSRF protection, and enabling a robust Backend-for-Frontend pattern that keeps the browser free from raw tokens.

Core Features & Use Cases

Server-side session management for SPAs and backends
API endpoint proxying with automatic token handling
CSRF/anti-forgery enforcement to protect protected endpoints
Deep integration with OpenID Connect / OAuth and React/Angular/Blazor frontends
Login/Logout flows and management endpoints support

Quick Start

Install and configure the Duende.BFF package in your ASP.NET Core app, enabling AddBff with OIDC and cookie options and wiring up UseBff to enforce anti-forgery and the BFF endpoints.

Frequently Asked Questions about duende-bff

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I secure OAuth tokens in a single-page application without exposing them to the browser?▼

A BFF pattern secures SPA tokens by managing sessions and tokens server-side, using API endpoint proxying with automatic token handling to ensure raw credentials are never exposed to the browser.

How do I set up anti-forgery and CSRF protection for an ASP.NET Core BFF?▼

You set up CSRF protection in an ASP.NET Core BFF by installing the BFF package, configuring AddBff with OIDC and cookie options, and wiring up UseBff to enforce anti-forgery on protected endpoints.

Does the BFF pattern work with React, Angular, and Blazor frontends?▼

Yes, the BFF pattern works with React, Angular, and Blazor SPAs, providing deep integration for secure token handling, API proxying, and precise login/logout flows across these frontend frameworks.

What is the best way to manage server-side sessions for an SPA architecture?▼

The best way to manage server-side sessions for an SPA is using a BFF pattern that supports server-side session storage, OpenID Connect integration, and optional reverse-proxy or EF-based session persistence.

Why do I need server-side token management instead of storing tokens in browser storage?▼

Server-side token management is needed to prevent exposing raw OAuth tokens to the browser, enforcing CSRF protection and enabling a robust BFF architecture that keeps sensitive data secure from client-side vulnerabilities.