Skip to content
Hallway
0:00 / 0:00

#bffpattern#oauth#openidconnect

Using the BFF pattern to secure SPA and Blazor Applications - Dominick Baier - NDC Oslo 2021

NDC Conferences

230K subscribers • 110 videos on Hallway • Conference channel

YouTube
  • Recommended by 3 people: 3 in engineering communities.
  • A classic. People kept recommending it from 2022 to 2025.
  • Presented by Dominick Baier

Intermediate. Assumes working knowledge.

13K views4 years ago3 recommendations

SecurityWeb developmentWeb and application securityHTTP, REST and GraphQLSoftware architecture

Dominick Baier explains how to secure single-page and Blazor applications using the Backend-for-Frontend pattern to avoid storing tokens in the browser.

Modern web development means that more and more application code is running in the browser. Traditionally this has been JavaScript but more recently there has been the trend to use C# with Blazor. These modern applications are often secured with token-based security using the OpenID Connect and OAuth protocols. But there are different patterns for using token-based security and this session covers some of the pitfalls of the various approaches, especially given the ever-changing browser landscape. We will focus on the “backend for frontend” (or BFF) pattern which has become the most secure and stable of these approaches. Check out more of our featured speakers and talks at ndcconferences.com/ ndcoslo.com/

Why it's here

3 people recommend this

What people say. Highly recommended for understanding OAuth, OIDC, and how to properly secure frontend applications using the BFF pattern.

u/pdevito3in r/dotnet • Recommends

On “.NET Identity Documentation has broken me”

Dominick from the duende team has some fantastic talks on OAuth and OIDC and was *the* thing that finally helped me wrap my head around all the bs and outdated sources on it. Here’s a couple, but there’s more too - about OAuth flows and best best practices - on BFF’s if you care about front ends - this okta video is decent too but Dominick’s talks are better I think There was a good metaphor of PKCE on a podcast too but I don’t even remember where that is lol
15View on Reddit

u/gowstaffin r/dotnet • Recommends

On “Securing .NET API & SPA frontend with Azure”

…icrosoft.com/en-us/azure/active-directory/develop/quickstart-v2-javascript-auth-code-react https://docs.microsoft.com/en-us/azure/active-directory/develop/tutorial-v2-react If you want a solution that is more secure than only using **Authorization Code Flow with PKCE**, you can look at **Duende Identity Server** and how to implement **BFF**: link to this video https://docs.duendesoftware.com/identityserver/v5/bff/overview/ https://docs.duendesoftware.com/identityserver/v5/bff/ https://docs.duendesoftware.com/identityserver/v5/samples/bff/ https://docs.duendesoftware.com/identityserver/v5/bff/tokens/…
2View on Reddit

u/kjbetzin r/dotnet • Recommends

On “Confused about ASP.NET Authentication (Identity, JWT and Social Logins)”

…d do the negotiating for the JWT (or other token) and store that for you. The client would make the calls to the web app and it would be forwarded by the web app to the other API. Basically a reverse proxy set up. You can use YARP for this. What you're avoiding by doing this is negotiating and, more importantly, storing the JWTs in the browser. [video…
1View on Reddit