Bff.AspNetCore
Reusable Backend-For-Frontend engine for ASP.NET Core. Terminates auth server-side: holds OIDC tokens in a Redis-backed session, hands the browser only an opaque httpOnly cookie, and forwards Bearer tokens to downstream services via YARP. Provider-agnostic — targets Keycloak (default, realm-scoped) or a generic OpenIddict provider (/connect/*), selectable per app. Server-side ROPC (Keycloak) or authorization-code + PKCE, silent refresh with a per-session SETNX lock, and CSRF protection. A per-app BFF becomes a ~20-line Program.cs.
Activity
- Latest release
- 5d ago
- Total releases
- 35
- Cadence
- ~daily
- Last 12 months
- 35
Details
- License
- MIT
- First release
- May 20, 2026
Releases