Sessions & Token Delegation

SaveTokens

SaveTokens controls whether OIDC tokens are retained in the authenticated session after sign-in.

EnableServerSideSessions

When enabled, authentication tickets are stored through ITicketStore rather than being carried entirely in the browser cookie.

flowchart LR
    B[Browser] -->|Small session cookie| BFF[BFF]
    BFF --> STORE[(ITicketStore)]
    STORE --> TICKET[Claims + authentication properties]
    TICKET --> TOKENS[Access / refresh / ID token\nwhen SaveTokens=true]

Development store

A memory-backed store is convenient for local development and examples, but it is process-local.

builder.Services.AddMemoryCache();
builder.Services.AddSingleton<ITicketStore, MemoryCacheTicketStore>();

Production scale-out

For multiple BFF instances, use a distributed ticket store appropriate to the deployment so requests can resolve the authenticated session regardless of which instance handles them.

TokenForwardingHandler

For HttpClient delegation, register the forwarding handler and attach it to the client that calls the protected service.

builder.Services.AddHttpContextAccessor();
builder.Services.AddTransient<TokenForwardingHandler>();

builder.Services
    .AddHttpClient("orders", client =>
    {
        client.BaseAddress = new Uri("https://orders.internal/");
    })
    .AddHttpMessageHandler<TokenForwardingHandler>();

Delegation flow

sequenceDiagram
    participant SPA
    participant BFF
    participant Store as ITicketStore
    participant API

    SPA->>BFF: GET /api/orders + session cookie
    BFF->>Store: Resolve authentication ticket
    Store-->>BFF: Claims + persisted access token
    BFF->>API: GET /orders + Bearer access token
    API-->>BFF: Protected response
    BFF-->>SPA: Response