Skip to content
Hallway
0:00 / 0:00

#backend-for-frontend#blazor#oauth

Securing SPAs and Blazor Applications using the BFF (Backend for Frontend) Pattern - Dominick Baier

NDC Conferences

230K subscribers • 110 videos on Hallway • Conference channel

YouTube
  • Recommended by 3 people: 3 in engineering communities.
  • Presented by Dominick Baier

Intermediate. Assumes working knowledge.

21K views3 years ago3 recommendations

SecurityWeb developmentWeb and application securitySoftware architectureHTTP, REST and GraphQL

Dominick Baier discusses the security pitfalls of client-side token management and explains how to implement the Backend-for-Frontend pattern.

Modern web development means that more and more application code is running in the browser. Traditionally this has been JavaScript but more recently there has been the trend to use C#/WASM with Blazor. These modern applications typically also need authentication and single-sign-on as well as token-based security for calling APIs – in other words OpenID Connect and OAuth 2. There are different patterns for securing such applications and this session covers some of the pitfalls of the various approaches, especially given the ever-changing browser landscape. We will conclude with the “backend for frontend” (or BFF) pattern which has become the most secure and stable of these approaches. Check out our new channel: NDC Clips: youtube.com/@UCDAfoBRLbriD_c4F-DznWcA Check out more of our featured speakers and talks at ndcconferences.com/ ndc-security.com/

Why it's here

3 people recommend this

What people say. Recommended as a key resource for understanding and implementing the Backend-for-Frontend pattern to secure modern web applications.

u/Shaddarin r/dotnet • Recommends

On “Are Cookies getting ditched in favor of JWT?”

No, because it is not possible to securely store a token in the browser. For SPAs the current best practice is to use a BFF + specifically configured cookies: David Fowler's TODO Api [Securing SPAs and Blazor Applications using the BFF (Backend for Frontend) Pattern - Dominick Baier ] The insecurity of OAuth 2.0 in frontends - Philippe de Ryck
92View on Reddit

u/Shaddarin r/dotnet • Recommends

On “How Can I Deal With Refresh Tokens In Blazor Webassembly?”

Here's a couple of excellent talks on this topic: The insecurity of OAuth 2.0 in frontends - Philippe de Ryck [Securing SPAs and Blazor Applications using the BFF (Backend for Frontend) Pattern ] SPAs shouldn't handle refresh tokens because they have no way of securely storing them.
2View on Reddit

u/zaibufin r/dotnet • Recommends

On “I need help with authentication in asp.net core.”

I did previously and implicit flow is no longer a recommended approach. Code flow with PKCE is a step up, but it also involves a lot of complexity in your client side to manage tokens, silent renews etc. It's much easier and more secure to manage this on the server. link to this video
1View on Reddit

u/Spirchin r/dotnet • Recommends

On “about the new auth in .net 8”

application scope = client side SPA the two major reference i can give are these two videos (these are what started me to look into BFF solution for SPA) [video [video (this one turn into an ads midway but the basis is still good)
1View on Reddit