Duende BFF Security Framework Releases

Duende SoftwareCommunication & Messaging Tools.NET

Learn what's new across releases, with details of features, enhancements, and resolved issues.

Jan
Feb
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct
Nov
Dec
Duende BFF Security Framework v4.2.0Jun 10, 2026
Features
  • You can now specify a custom IAccessTokenRetriever through YARP route or cluster metadata.
Fixes
  • Cookie name prefix constants (__Host-, __Secure-) now correctly include the trailing hyphen.
Duende BFF Security Framework v4.1.2Mar 13, 2026
Features
  • Updated Duende.IdentityModel dependency to 8.0.1.
Duende BFF Security Framework v4.1.1Feb 18, 2026
Fixes
  • Fixed an issue where BFF will crash when openid connect options are retrieved outside of HTTP Request context.
  • Fixed an issue with Stackoverflow when BFF is explicitly configured with Authentication schemes, but without ForbidScheme.
Duende BFF Security Framework v4.0.3Jan 29, 2026
Fixes
  • Fixed issue where yarp proxying doesn't calculate htu correctly.
Duende BFF Security Framework v4.1.0Jan 29, 2026
Features
  • Introduced new extensibility point to enrich the claims from the user endpoint.
Duende BFF Security Framework v4.0.2Jan 13, 2026
Fixes
  • Fixed nullability issues with ClaimRecord and ClaimsPrincipalRecord.