An extendible framework for .NET to implement the BFF Security Pattern (a.k.a. Token Handler Pattern) in Single Page Applications.
Get Started
$ dotnet add package OidcProxy.Net.EntraIdReadme
OidcProxy.Net.EntraId
This package contains the software you need to implement the BFF Security Pattern. This software does three things:
- It manages the user session
- It allows the user to log into the site
- It forwards request to downstream services and adds the Authorization header with the user's access token to the requests
OidcProxy.Net is a stateful reverse proxy. To forward requests to downstream services OidcProxy.Net uses YARP.
Currently, OidcProxy.Net supports logging in with Azure, Auth0, IdentityServer4, and any other OpenID Connect compliant authorization server. Currently, only the Authorization Code flow with Proof-Key Client Exchange is supported.
Quickstart: Implementing the BFF Security Pattern
To build it, execute the following commands:
dotnet new web
dotnet add package OidcProxy.Net.EntraId
Create the following Program.cs file:
using OidcProxy.Net.EntraId;
using OidcProxy.Net.ModuleInitializers;
var builder = WebApplication.CreateBuilder(args);
var entraIdConfig = builder.Configuration
.GetSection("OidcProxy")
.Get<EntraIdProxyConfig>();
builder.Services.AddEntraIdProxy(entraIdConfig);
var app = builder.Build();
app.UseEntraIdProxy();
app.Run();
Create the following appsettings.json file:
{
"Logging": {
"LogLevel": {
"Default": "Information",
"Microsoft.AspNetCore": "Warning"
}
},
"EntraId": {
"ClientId": "{yourClientId}",
"ClientSecret": "{yourClientSecret}",
"TenantId": "{yourTenantId}",
"DiscoveryEndpoint": "{https://login.microsoftonline.com/{tenantId}/v2.0/.well-known/openid-configuration}",
"Scopes": [
"openid", "profile", "offline_access", "https://yourDomain.onmicrosoft.com/test/api1"
]
},
"AllowedHosts": "*",
"OidcProxy": {
"LandingPage": "/hello",
"EntraId": {
"ClientId": "{yourClientId}",
"ClientSecret": "{yourClientSecret}",
"Scopes": [
"openid",
"profile",
"offline_access",
"https://foo.onmicrosoft.com/api/test/weatherforecast.read"
]
},
"ReverseProxy": {
"Routes": {
"api": {
"ClusterId": "api",
"Match": {
"Path": "/api/{*any}"
}
}
},
"Clusters": {
"api": {
"Destinations": {
"api/node1": {
"Address": "https://{your_api}/"
}
}
}
}
}
}
}