Backend for Frontend for ASP.NET Core Authentication

Example of how to use the Backend for Frontend (BFF) pattern for ASP.NET Core Authentication. We explore how to store tokens on the backend and call external api's via your service.

#aspnetcore #authentication #bff

[shakeuk]

Great video, i feel authentication is the Achilles Heel for a lot of developers, SPAs are great but should not be looking after access/identity tokens as its just not secure.

[fieryscorpion]

Could you please make a video of a setup that's like damienbod's *bff-aspnetcore-angular* Git repo?

[jamesterstudio]

oHey Great video, did you create a github for this coding tutorial?

[mibli]

Please consider making a video on how to merge this tutorial with Blazor Webassembly Hosted App. Thanks!

[TellaTrix]

Yo Yo not everybody is like you smart ad intelligent. Too fast bit bouncy over all your content. Thanks for sharing.

[pqyh]

If I understood correctly, this pattern means that even if an SPA can authenticate directly by calling the OAuth endpoint, for example when using Auth0, the best practice is to do this only through the backend, or is it something else ?

[jamesterstudio]

Do you have an example where we are using google for authentication?

[tombalabomba]

How do you redirect to youtube from your view frontend? Does the connect-youtube endpoint send back a redirect url with oidc params?

[TheAzerue]

Hi
Very good video. Three question. In a monolith app with no external authentication, just on the same server authentication.
Q1. Is storing a token in local storage a bad practice from security point of view, even if we are doing an Api call same server and not on some external server like youtube, facebook ?
Q2. If we are hitting apis only on our server, is authenticating a user with username and password is flawed ?. I mean is OpenId Connect still a best practice or it is over kill.
Q3. With BFF when using refresh token to get an access token. Is middleware a best play to implement this ?

What i understand from your BFF video, is token is stored at backend and with frontend only a small is cookie, that could contain a user-id. And then each an Api is called, we grab the token against that user-Id, populate the ClaimsPrincipal and complete an Api either external or on same server.

Thank you again. I'm learning a lot from you Sensi :).

[aligeovany]

hi please share a a video for creating 'SSO' and do that just with pure C# code, I mean don't use Identity Server or etc. Teach this tech with pure code. thanks

[TheAzerue]

Do you think using Distributed cache in Db is good way to store token against cookie ?

[xardasu]

Dotwatch ? . Where can I get the CLI ?

[JamesterGo]

I tried the fetch thing but it does not redirect to google