Developer Tools / Methrax.Bff.AspNetCore / Endpoints & SPA Integration

Endpoints & SPA Integration

The package/reference sample exposes the BFF authentication surface used by browser applications.

Endpoint suite

Endpoint	Purpose
`/login`	Starts the OIDC authentication challenge.
`/logout`	Terminates the local session and initiates sign-out.
`/user`	Returns authenticated user/session information to the SPA.
`/token-info`	Diagnostic/session token information in the reference sample. Do not expose sensitive token material to untrusted clients.
`/access-denied`	Handles authorization denial.

Paths that are configurable should be treated as application contracts: if you change them, update the SPA links/client accordingly.

Angular session check

The Angular application should ask the BFF for session/user state rather than decoding browser-stored JWTs.

this.http.get("/user", {
  withCredentials: true,
});

Request model

sequenceDiagram
    participant Angular
    participant BFF
    participant API as Downstream API

    Angular->>BFF: GET /user + session cookie
    BFF-->>Angular: user/session model
    Angular->>BFF: GET /api/orders + session cookie
    BFF->>API: request + Bearer token
    API-->>BFF: protected data
    BFF-->>Angular: application response

Frontend rules

Do not persist OAuth access/refresh tokens in local storage or application state.
Treat /user (or your chosen session endpoint) as the source of authentication state.
Send credentials according to your same-site/cross-origin deployment model.
Route protected API calls through the BFF boundary when user-token delegation is required.