Duende BFF Security Framework

Duende SoftwareCommunication & Messaging Tools.NET

Secure browser frontends with server-managed tokens and robust protections.

  • Implements Backend-For-Frontend pattern for modern SPA and Blazor apps.
  • Manages authentication tokens server-side to reduce the risk of token exposure in the browser.
  • Provides built-in CSRF protection and supports multi-frontend scenarios.
Duende Software logo

Prices from:

Loading...
Available in
IdentityServerLoading
Simplify your front-end development and increase security.
Duende BFF Security Framework enables robust security for browser-based frontend applications by handling authentication and token management entirely on the server side. This framework supports SPA and Blazor frontends paired with ASP.NET Core backends, reducing the risk of token exposure in the browser and providing protections such as CSRF mitigation and session management.

Server-Side Token Management

Handles OAuth 2.0 and OpenID Connect token flows on the backend, ensuring tokens are not exposed to the browser, reducing risks from XSS and other client-side attacks.

Built-In CSRF Protection

Enforces Cross-Site Request Forgery protection by requiring custom headers on API requests and integrating SameSite and Secure cookie policies to defend against CSRF attacks and enforce secure cross-origin request handling.

Multi-Frontend Support

Supports multiple frontend applications connecting to a single Backend For Frontend host, allowing flexible architectures and efficient resource use for complex deployments.

Session State Management

Manages logical and physical user sessions on the server, coordinating session lifetimes across APIs with support for server-side session storage and back-channel logout notifications.

API Proxying and Security

Acts as a reverse proxy to securely route frontend API calls to local or external backend services, exchanging authentication cookies for tokens as needed without exposing them to the browser.

OpenTelemetry Integration

Provides observability features through OpenTelemetry support, enabling advanced monitoring and diagnostics of authentication flows and session management.

Blazor Authentication Support

Integrates seamlessly with Blazor applications, managing authentication states server-side to simplify development and maintain robust security.

Resilient to Browser Security Changes

Designed to handle evolving browser security models such as restrictions on third-party cookies, ensuring reliable authentication flows despite tightened browser privacy controls.

Product Compatibility

Review the details below to ensure this product is supported within your environment.

Component Type

  • .NET

.NET Version

  • .NET 10 LTS
  • .NET 9 STS
  • .NET 8 LTS

.NET Platform

  • ASP.NET Core Assembly

IDE Support

  • Visual Studio