duende-bff
Duende BFF (Backend for Frontend) security framework for securing SPAs. Covers session management, API endpoint proxying, token management, anti-forgery protection, and integration with React/Angular/Blazor frontends.
Install
With your agent
Install OMGSkills skill "duendesoftware/duende-skills:skills/duende-bff" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/DuendeSoftware/duende-skills /tmp/duende-skills && ln -s /tmp/duende-skills/skills/duende-bff ~/.claude/skills/duende-bffFrom README
Duende BFF (Backend for Frontend) When to Use This Skill Building or securing a SPA (React, Angular, Vue, Blazor WASM) that calls APIs requiring authentication Implementing the Backend-for-Frontend security pattern to keep access tokens out of the browser Configuring BFF session management, login/logout endpoints, and server-side sessions Proxying requests from a frontend to remote APIs while automatically attaching access tokens Adding CSRF/anti-forgery protection to APIs consumed by browser-based applications Integrating Duende.BFF with Duende.AccessTokenManagement for automatic token refresh Deploying a BFF behind a reverse proxy or configuring same-site cookie behavior Core Principles Tokens Never Touch the Browser — The BFF holds all OAuth tokens server-side; the browser only ever sees an HTTP-only, Secure, SameSite cookie CSRF Protection Is Mandatory — Every BFF API endpoint must require the X-CSRF: 1 header; use .AsBffApiEndpoint() or MapRemoteBffApiEndpoint — never skip it...
More from this repo
aspnetcore-authentication
ASP.NET Core authentication middleware configuration including OpenID Connect, JWT Bearer, cookie authentication,...
aspnetcore-authorization
ASP.NET Core authorization patterns including policy-based authorization, IAuthorizationHandler implementations,...
claims-authorization
Claims transformation and profile service patterns for Duende IdentityServer — IProfileService, IClaimsTransformation,...