METHRAX
Developer Tools / Methrax.Bff.AspNetCore / Configuration Reference

Configuration Reference

All package configuration is rooted under Methrax:BffAuthentication.

Root options

Property Type Required Default Description
Authority string Yes "" OIDC authority URL.
ClientId string Yes "" OAuth/OIDC client identifier.
ClientSecret string Yes for confidential clients "" Client secret. Keep outside source control.
RequireHttpsMetadata bool No true Require HTTPS for OIDC metadata.
SaveTokens bool No true Persist OIDC tokens in authentication properties/ticket.
EnableServerSideSessions bool No false Use registered ITicketStore for server-side sessions.
Scopes string[] No openid, profile, offline_access Requested OIDC scopes.
Cookie object No See below Cookie security settings.
Endpoints object No See below Authentication route paths.
Tokens object No See below Token property key mappings.
Property Type Default Description
SameSite SameSiteMode Lax Cookie cross-site behavior.
SecurePolicy CookieSecurePolicy Always HTTPS-only transmission policy.
HttpOnly bool true Prevent browser JavaScript from reading the auth cookie.

Endpoint options

Property Default Description
LoginPath /login Starts the OIDC login challenge.
LogoutPath /logout Signs out the local session and initiates OIDC sign-out as configured.
AccessDeniedPath /access-denied Redirect/handling path for denied access.

All configured paths must begin with /.

Token key options

Property Default Description
AccessToken access_token Authentication property key for the access token.
RefreshToken refresh_token Authentication property key for the refresh token.
IdToken id_token Authentication property key for the ID token.
ExpiresAt expires_at Authentication property key for expiry timestamp.

Complete example

{
  "Methrax": {
    "BffAuthentication": {
      "Authority": "https://identity-provider.example.com/realms/main",
      "ClientId": "interactive.confidential",
      "ClientSecret": "secret-from-secure-config",
      "RequireHttpsMetadata": true,
      "SaveTokens": true,
      "EnableServerSideSessions": true,
      "Scopes": ["openid", "profile", "offline_access", "api"],
      "Cookie": {
        "SameSite": "Lax",
        "SecurePolicy": "Always",
        "HttpOnly": true
      },
      "Endpoints": {
        "LoginPath": "/login",
        "LogoutPath": "/logout",
        "AccessDeniedPath": "/access-denied"
      },
      "Tokens": {
        "AccessToken": "access_token",
        "RefreshToken": "refresh_token",
        "IdToken": "id_token",
        "ExpiresAt": "expires_at"
      }
    }
  }
}