skills.rest
DuendeSoftware
DuendeSoftwareOFFICIAL
Explore all skills by this author →
Website𝕏@duendeidentityGitHub

duende-bff

Manage server-side sessions, tokens, and CSRF enforcement for SPA backends.

10|2|Updated Mar 16, 2026
Search Tags:#dotnet#bff#csrf#aspnet-core#token-management#openid-connect#spa-security
One-click install
npx skills add https://github.com/DuendeSoftware/duende-skills --skill duende-bff
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: duende-bff
Source: https://github.com/DuendeSoftware/duende-skills/tree/main/skills/duende-bff
Command: npx skills add https://github.com/DuendeSoftware/duende-skills --skill duende-bff

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Secures single-page applications by moving OAuth tokens and sensitive data server-side, enforcing CSRF protection, and enabling a robust Backend-for-Frontend pattern that keeps the browser free from raw tokens.

Core Features & Use Cases

  • Server-side session management for SPAs and backends
  • API endpoint proxying with automatic token handling
  • CSRF/anti-forgery enforcement to protect protected endpoints
  • Deep integration with OpenID Connect / OAuth and React/Angular/Blazor frontends
  • Login/Logout flows and management endpoints support

Quick Start

Install and configure the Duende.BFF package in your ASP.NET Core app, enabling AddBff with OIDC and cookie options and wiring up UseBff to enforce anti-forgery and the BFF endpoints.

Frequently Asked Questions about duende-bff

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure OAuth tokens in a single-page application without exposing them to the browser?▼

A BFF pattern secures SPA tokens by managing sessions and tokens server-side, using API endpoint proxying with automatic token handling to ensure raw credentials are never exposed to the browser.

How do I set up anti-forgery and CSRF protection for an ASP.NET Core BFF?▼

You set up CSRF protection in an ASP.NET Core BFF by installing the BFF package, configuring AddBff with OIDC and cookie options, and wiring up UseBff to enforce anti-forgery on protected endpoints.

Does the BFF pattern work with React, Angular, and Blazor frontends?▼

Yes, the BFF pattern works with React, Angular, and Blazor SPAs, providing deep integration for secure token handling, API proxying, and precise login/logout flows across these frontend frameworks.

What is the best way to manage server-side sessions for an SPA architecture?▼

The best way to manage server-side sessions for an SPA is using a BFF pattern that supports server-side session storage, OpenID Connect integration, and optional reverse-proxy or EF-based session persistence.

Why do I need server-side token management instead of storing tokens in browser storage?▼

Server-side token management is needed to prevent exposing raw OAuth tokens to the browser, enforcing CSRF protection and enabling a robust BFF architecture that keeps sensitive data secure from client-side vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
codewithmukeshcodewithmukesh
640

authentication

Configure JWT bearer and cookie authentication for ASP.NET Core applications.

Official
Intermediate
adelabdelgawadadelabdelgawad

auth-session

Implement cookie-based authentication and session management for Leptos+Axum apps.

Community
Advanced
ckrono-progckrono-prog

replit-auth

Set up Replit OpenID Connect and PKCE authentication in Express, React, and React Native projects.

Community
Advanced
hopeoverturehopeoverture

worldcrafter-auth-guard

Enforce Supabase Auth authentication and RBAC on routes, actions, and APIs.

Community
Advanced