Securing SPAs and Blazor Applications using the BFF (Backend for Frontend) Pattern - Dominick Baier

Modern web development means that more and more application code is running in the browser. Traditionally this has been JavaScript but more recently there has been the trend to use C#/WASM with Blazor.

These modern applications typically also need authentication and single-sign-on as well as token-based security for calling APIs – in other words OpenID Connect and OAuth 2. There are different patterns for securing such applications and this session covers some of the pitfalls of the various approaches, especially given the ever-changing browser landscape. We will conclude with the “backend for frontend” (or BFF) pattern which has become the most secure and stable of these approaches.

Check out our new channel:
NDC Clips:

Check out more of our featured speakers and talks at

[BrendanAlexander]

Great talk! I understand things with respect to a SPA.. But not sure how things work with openid connect and a mobile app.

[fieryscorpion]

Can you please share the source code that you used in the demo?

[povdata]

So, we back again to cookie, so we need store them to identificate user on BFF layer, is not?

[torrvic]

Sounds very complicated but really interesting. What I’ve got from this video is that we should use our backend API to work with all of this authentication and authorisation stuff and that we should not use our frontend for this purposes.

[tombalabomba]

In the OIDC authorization code flow with pkce, which would be taken care of here through the bff, the user will be redirected to a signin page on the Idp. How can the spa redirect the user to the idp without getting the redirect url from the bff? Wouldn't the spa have to get the redirect url from the bff, including any clientId and codeChallenge?

[fieryscorpion]

How do we secure mobile apps? Can this pattern work with mobile as well?

[nathangrosvenor]

Could this be used on SSR applications?

[tombalabomba]

If an attacker has access to your client-application, he can make api calls regardles of using auth with session-tokens or http-only cookies. BFf just seems to add unnecessary complexity.

[vixntjf]

So all in all this is just an advertising for Deunde server product?

[chauchau]

The world does come full circle. This so called "BFF" is exactly the same old traditional way how application handles oauth login before so many misinformed incompetent developers bindly doing things just because they could. Now these people reinvent the wheel with a new fancy name for a decade old technique like they imvented it. Yay!

[Alperic]

going back to 20y ago is a waste of time …