10 questions
-1
votes
1
answer
101
views
BFF to microservice: client credentials or token-forwarding [closed]
I currently have an admin console that is served a BFF layer and 2 REST microservices - product microservice and user microservice. The user microservice stores information on login users as well as ...
- 3
0
votes
1
answer
78
views
How can I handle a sign-in fail to redirect to Angular with OpenIdConnectEvents
I have setup an bff application architecture with an Angular SPA app and an ASP.NET Core 9 Web API that uses OpenId Connect to do single sign on with Microsoft EntraId and Microsoft, Google identity ...
- 374
0
votes
1
answer
176
views
After implementing Duende BFF deployed web app not working
I followed the sample project bff react on our project. Our project is an asp.net core web application (.net8) with spa (react and vite). On local development environment it is working fine. After ...
- 190
0
votes
1
answer
510
views
Keycloak and BFF
I'm trying to use the BFF (Backend for Frontend) pattern with my C#/Angular application and Keycloak (v. 26.0.7).
I have set up one Keycloak client for the C# backend:
...and another one for the ...
- 181
1
vote
1
answer
437
views
CORS Issues with Backend for Frontend (BFF) in .NET Core API and Angular using Keycloak
I'm trying to implement a Backend for Frontend (BFF) architecture using a .NET Core API and an Angular app. The identity provider I'm using is Keycloak.
When the Angular app starts, it makes an HTTP ...
- 63
0
votes
1
answer
110
views
Could HttpOnly cookie be accessed in browser by malicious JS
In the Backend-For-Frontend (BFF) description here. The last sentence in the section caught my concern, it says:
Since the malicious JavaScript code still runs within the
application's origin, the ...
- 6,129
0
votes
1
answer
408
views
How is latency handled in the BFF pattern? Looking for some examples
I'm seeking a practical approach/example to address latency concerns with the BFF pattern. While the definition suggests there's no increased latency with this pattern, I'm curious about how this is ...
- 3,077
1
vote
1
answer
428
views
Handing OAuth2 refresh token race conditions
We're implementing a 'BFF' (Backend for Frontend) pattern for our application, which is a recommendation from the draft-ietf-oauth-browser-based-apps.
One complication we're running into is handing ...
- 101k
0
votes
1
answer
114
views
Which permissions define visibility for SPA pages
I have a ASP.NET React Web Application. For authentication I use Auth0, using the server side (C#) as Backend-For-Frontend (see this blog for more details). So all the client side (React) see, are the ...
- 6,201
0
votes
1
answer
520
views
Avoid redirect on unauthorized with OpenIdConnect
I am trying to setup a C# with React web application, using the C# backend as Backend-For-Frontend, so I can use cookie authentication. I am somewhat following this tutorial, but using the newest C#/...
- 6,201