You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
***Authentication flows**: The server handles the authentication flows. There are specific endpoints for login / logout. While the browser is involved with these authentication flows, because the user is redirected to and from the identity provider, the browser-based application will never see the authentication tokens. These are exchanged for a code on the server only.
33
+
***Cookies**: After successful authentication, a cookie is added. This cookie protects all subsequent calls to the APIs. When using this type of authentication, **CSRF protection** is very important.
34
+
***Access to APIs**: The BFF can expose embedded APIs (which are hosted by the BFF itself) or proxy calls to remote APIs (which is more common in a microservice environment). While proxying, it will exchange the authentication cookie for an access token.
35
+
***Session Management**: The BFF can manage the users session. This can either be cookie-based session management or storage-based session management.
36
+
37
+
38
+
## Internals
27
39
Duende.BFF builds on widely used tools and frameworks, including ASP.NET Core's OpenID Connect and cookie authentication
28
-
handlers, YARP, and Duende.AccessTokenManagement. Duende.BFF combines these tools and adds additional security and
40
+
handlers, YARP, and [Duende.AccessTokenManagement](/accesstokenmanagement/index.mdx). Duende.BFF combines these tools and adds additional security and
29
41
application features that are useful with a BFF architecture so that you can focus on providing application logic
Copy file name to clipboardExpand all lines: src/content/docs/bff/architecture/multi-frontend.md
+37-2Lines changed: 37 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,7 +29,7 @@ The Duende BFF V4 library doesn't ship with an abstraction to store or read fron
29
29
30
30
## A Typical Example
31
31
32
-
Consider an enterprise that hosts multiple browser based applications. Each of these applications is developed by a separate team and as such, has it's own deployment schedule.
32
+
Consider an enterprise that hosts multiple browser based applications. Each of these applications is developed by a separate team and as such, has its own deployment schedule.
33
33
34
34
There are some internal-facing applications that are exclusively used by internal employees. These internal employees are all present in Microsoft Entra ID, so these internal-facing applications should directly authenticate against Microsoft Entra ID. These applications also use several internal APIs, that due to the sensitivity, should not be accessible by external users. However, they also use some of the more common APIs. These apps are only accessible via an internal DNS name, such as `https://app1.internal.example.com`.
35
35
@@ -60,6 +60,41 @@ After your application's logic is executed, there are two middlewares registered
60
60
61
61
5.`MapRemoteRoutesMiddleware` - This will handle any configured remote routes. Note, it will not handle plain YARP calls, only routes that are specifically added to a frontend.
62
62
63
-
6.`ProxyIndexMiddleware` - If configured, this proxy the `index.html` to start the browser based app.
63
+
6.`ProxyIndexMiddleware` - If configured, this proxies the `index.html` to start the browser based app.
64
64
65
+
If you don't want this automatic mapping of BFF middleware, you can turn it off using `BffOptions.AutomaticallyRegisterBffMiddleware`. When doing so, you'll need to manually register and add the middlewares:
66
+
67
+
```csharp
68
+
varapp=builder.Build();
69
+
70
+
app.UseBffFrontendSelection();
71
+
app.UseBffPathMapping();
72
+
app.UseBffOpenIdCallbacks();
73
+
74
+
// TODO: your custom middleware goes here
75
+
app.UseRouting();
76
+
app.UseBff();
77
+
78
+
// NOTE: Only add this if you want to proxy remote APIs.
79
+
app.UseBffRemoteRoutes();
80
+
81
+
app.MapBffManagementEndpoints();
82
+
app.UseBffIndexPages();
83
+
84
+
app.Run();
85
+
```
86
+
87
+
## Authentication Architecture
88
+
89
+
When you use multiple frontends, you can't rely on [manual authentication configuration](../fundamentals/session/handlers.mdx#manually-configuring-authentication). This is because each frontend requires its own scheme, and potentially its own OpenID Connect and Cookie configuration.
90
+
91
+
The BFF registers a dynamic authentication scheme, which automatically configures the OpenID Connect and Cookie Scheme's on behalf of the frontends. It does this using a custom `AuthenticationSchemeProvider` called `BffAuthenticationSchemeProvider` to return appropriate authentication schemes for each frontend.
92
+
93
+
The BFF will register two schemes:
94
+
*`duende-bff-oidc`
95
+
*`duende-bff-cookie`
96
+
97
+
Then, if there are no default authentication schemes registered, it will register 'duende_bff_cookie' schemes as the `AuthenticationOptions.DefaultScheme`, and 'duende_bff_oidc' as the `AuthenticationOptions.DefaultAuthenticateScheme` and `AuthenticationOptions.DefaultSignOutScheme`. This will ensure that calls to `Authenticate()` or `Signout()` will use the appropriate schemes.
98
+
99
+
If you're using multiple frontends, then the BFF will create dynamic schemes with the following signature: `duende_bff_oidc_[frontendname]` and `duende_bff_cookie_[frontendname]`. This ensures that every frontend can use its own OpenID Connect and Cookie settings.
Copy file name to clipboardExpand all lines: src/content/docs/bff/extensibility/http-forwarder.md
+88-39Lines changed: 88 additions & 39 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -17,7 +17,8 @@ You can customize the HTTP forwarder behavior in two ways
17
17
* provide a customized HTTP client for outgoing calls
18
18
* provide custom request/response transformation
19
19
20
-
### Custom HTTP clients
20
+
## Custom HTTP Clients
21
+
21
22
By default, Duende.BFF will create and cache an HTTP client per configured route or local path.
22
23
23
24
This invoker is set up like this:
@@ -32,64 +33,112 @@ var client = new HttpMessageInvoker(new SocketsHttpHandler
32
33
});
33
34
```
34
35
35
-
If you want to customize the HTTP client for specific paths, you can either implement the *IHttpMessageInvokerFactory* interface or derive from the *DefaultHttpMessageInvokerFactory*, e.g.:
36
+
If you want to customize the HTTP client you can implement the `IForwarderHttpClientFactory` interface, e.g.:
// You can also add custom transformers, such as this one that adds an additional header
88
+
context.AddRequestHeader("custom", "with value");
89
+
90
+
});
91
+
```
92
+
93
+
The default transform builder performs these transforms:
94
+
95
+
```csharp
96
+
context.AddRequestHeaderRemove("Cookie");
97
+
context.AddPathRemovePrefix(localPath);
98
+
context.AddBffAccessToken(localPath);
99
+
```
100
+
101
+
For more information, also see the [YARP documentation on transforms](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/yarp/transforms?view=aspnetcore-9.0)
102
+
103
+
### Changing The Default Transformer
104
+
105
+
You can change the default transformer builder delegate by registering one in the services collection:
// 100 ms timeout, which is not too short that the normal process might fail,
138
+
// but not too long that the test will take forever
139
+
ActivityTimeout=TimeSpan.FromMilliseconds(100)
140
+
});
89
141
```
90
142
91
-
...or derive from the *DefaultHttpTransformerFactory*.
92
143
93
-
:::note
94
-
The transformations are based on YARP's transform library and are extensible. See [here](https://microsoft.github.io/reverse-proxy/articles/transforms.html) for a full list of built-in transforms.
0 commit comments