What may cause the BFF to pass on an expired token?

[norgie]

When logging into a SPA (-> BFF -> IdentityServer -> EntraId), we notice that the token passed on by the BFF to the back-end services (web api) has expired, e.g. the expire date is older than today. I got a colleague who hasn't tried this SPA before to try to log in as well and the result is the same. The call from the SPA via the BFF to a separate web-api (not hosted by the BFF) carries with it an expired token. This is the token validation error we receive: ERROR IDX10223: Lifetime validation failed. The token is expired. ValidTo (UTC): '15.01.2026 15:50:29', Current time (UTC): '16.01.2026 10:07:29'.

The IdP, the BFF and the web-api are being hosted on the same server. We're using BFF 3.x.

My colleague and I are at loss as to why this is even an issue and any help/pointers is highly appreciated.

TIA

[wcabus]

Is this related to https://github.com/orgs/DuendeSoftware/discussions/438? If yes, let's continue the discussion there to keep track of everything :)

[norgie]

It is, but it is unrelated to WCF.

[norgie]

Moved to https://github.com/orgs/DuendeSoftware/discussions/438

(edit: added link)