Released: Jun 10, 2026

Updates in v4.2.0

Features

• You can now specify a custom IAccessTokenRetriever through YARP route or cluster metadata.

Fixes

• Cookie name prefix constants (__Host-, __Secure-) now correctly include the trailing hyphen.

Released: Mar 13, 2026

Updates in v4.1.2

Features

• Updated Duende.IdentityModel dependency to 8.0.1.

Released: Feb 18, 2026

Updates in v4.1.1

Fixes

• Fixed an issue where BFF will crash when openid connect options are retrieved outside of HTTP Request context.
• Fixed an issue with Stackoverflow when BFF is explicitly configured with Authentication schemes, but without ForbidScheme.

Released: Jan 29, 2026

Updates in v4.1.0

Features

• Introduced new extensibility point to enrich the claims from the user endpoint.

Released: Jan 29, 2026

Updates in v4.0.3

Fixes

• Fixed issue where yarp proxying doesn't calculate htu correctly.

Released: Jan 13, 2026

Updates in v4.0.2

Fixes

• Fixed nullability issues with ClaimRecord and ClaimsPrincipalRecord.

Released: Dec 12, 2025

Updates in v4.0.1

Fixes

• Fixed a problem with BFF when using DPoP. BFF should use the AccessToken instead of the serialized version of the token representation.

Released: Dec 2, 2025

Updates in v4.0.0

Features

• Added support for .NET 10.
• You can now check authentication state.
• Introduced BFF Trial Mode.
• Introduced Diagnostics in BFF.
• Updated the referenced Duende FOSS packages to their respective GA versions which added .NET 10 as a target.

Fixes

• Fixed entity framework scoping issue in ServerSideSessionChecker.
• Fixed an issue that prevents you from requesting a client credentials token from a background service.

Released: Mar 17, 2025

Updates in v3.0.0

Features

• .NET 9 Support.
• Blazor Support:
  • Provides comprehensive support for authentication in Blazor applications. The BFF pattern centralizes authentication logic on the server side, creating a secure environment for managing user identities and sessions.
  • As with other browser based applications, the actual authentication logic is handled on the server by the Duende BFF Security Framework. On the client, the BFF makes sure that the authentication state is in sync with the session on the server...