# duende-bff

> Claude/Codex skill by [@duendesoftware](https://omgskills.com/library/duendesoftware/index.md) · 9 stars · Updated 2026-10-16

Duende BFF (Backend for Frontend) security framework for securing SPAs. Covers session management, API endpoint proxying, token management, anti-forgery protection, and integration with React/Angular/Blazor frontends.

Tags: ai-agents, claude, claude-code

## Install

```sh
git clone https://github.com/DuendeSoftware/duende-skills /tmp/duende-skills && ln -s /tmp/duende-skills/skills/duende-bff ~/.claude/skills/duende-bff
```

## From README

Duende BFF (Backend for Frontend) When to Use This Skill Building or securing a SPA (React, Angular, Vue, Blazor WASM) that calls APIs requiring authentication Implementing the Backend-for-Frontend security pattern to keep access tokens out of the browser Configuring BFF session management, login/logout endpoints, and server-side sessions Proxying requests from a frontend to remote APIs while automatically attaching access tokens Adding CSRF/anti-forgery protection to APIs consumed by browser-based applications Integrating Duende.BFF with Duende.AccessTokenManagement for automatic token refresh Deploying a BFF behind a reverse proxy or configuring same-site cookie behavior Core Principles Tokens Never Touch the Browser — The BFF holds all OAuth tokens server-side; the browser only ever sees an HTTP-only, Secure, SameSite cookie CSRF Protection Is Mandatory — Every BFF API endpoint must require the X-CSRF: 1 header; use .AsBffApiEndpoint() or MapRemoteBffApiEndpoint — never skip it...

## Links

- HTML page: https://omgskills.com/library/duendesoftware/duende-skills/skills/duende-bff/
- GitHub: https://github.com/DuendeSoftware/duende-skills
- Author: [@duendesoftware](https://omgskills.com/library/duendesoftware/index.md)

## More from this repo

- [aspnetcore-authentication](https://omgskills.com/library/duendesoftware/duende-skills/skills/aspnetcore-authentication/index.md) — ASP.NET Core authentication middleware configuration including OpenID Connect, JWT Bearer, cookie authentication,...
   - [@duendesoftware](https://omgskills.com/library/duendesoftware/index.md) · 9 stars
- [aspnetcore-authorization](https://omgskills.com/library/duendesoftware/duende-skills/skills/aspnetcore-authorization/index.md) — ASP.NET Core authorization patterns including policy-based authorization, IAuthorizationHandler implementations,...
   - [@duendesoftware](https://omgskills.com/library/duendesoftware/index.md) · 9 stars
- [claims-authorization](https://omgskills.com/library/duendesoftware/duende-skills/skills/claims-authorization/index.md) — Claims transformation and profile service patterns for Duende IdentityServer — IProfileService, IClaimsTransformation,...
   - [@duendesoftware](https://omgskills.com/library/duendesoftware/index.md) · 9 stars