Methrax.Bff.AspNetCore

A Methrax library for implementing the Backend-for-Frontend authentication pattern in ASP.NET Core applications, centered on OpenID Connect, PKCE, secure cookie sessions and server-side session storage.

Source: GitHub

Why a BFF?

The BFF keeps authentication responsibilities and sensitive token handling on the server side while the browser works with a secure session cookie.

flowchart TB
    SPA[Browser / SPA] -->|Secure HttpOnly session cookie| BFF[ASP.NET Core BFF]
    BFF <-->|OIDC Authorization Code + PKCE| IDP[Identity Provider]
    BFF -->|Server-side access token| API[Downstream API]

Features

• Centralized browser authentication at the BFF boundary.
• Access tokens kept out of application JavaScript.
• OIDC Authorization Code flow with PKCE.
• Reusable login, logout, access-denied, and user/session endpoints.
• Server-side ticket and session persistence.
• Secure cookie-based browser sessions.
• Token forwarding to downstream APIs from the server boundary.