Upgrading BFF Security Framework
Upgrading to a new Duende.BFF version is done by updating the NuGet package and handling any breaking changes.
Behavior Changes In Patch Releases
Section titled “Behavior Changes In Patch Releases”Some patch releases change a default to fix a security issue. Check the changes below when you update to a newer patch version, and test the affected routes.
Frontend Remote APIs Require The Anti-Forgery Header
Section titled “Frontend Remote APIs Require The Anti-Forgery Header”This change applies to 4.0.4, 4.1.3, 4.2.1, and 4.3.1.
Remote APIs that you define on a frontend, with WithRemoteApis or with Frontends:<name>:RemoteApis in configuration, were proxied with an access token without checking the anti-forgery header. The BFF now requires the header (X-CSRF: 1 by default) on these routes before it attaches the token. Requests without it get 401, and the BFF logs a warning. MapRemoteBffApiEndpoint, local BFF APIs, and YARP routes configured with the anti-forgery check already had this protection.
Make sure your frontend sends the header on every call to these APIs. The check respects BffOptions.DisableAntiForgeryCheck. There’s no per-API opt-out. Learn more about anti-forgery protection for remote APIs.
YARP Routes No Longer Forward The Cookie Header
Section titled “YARP Routes No Longer Forward The Cookie Header”This change applies to 2.2.1, 2.3.1, 3.0.1, 3.1.1, 4.0.4, 4.1.3, 4.2.1, and 4.3.1.
Routes proxied through the BFF YARP integration (AddYarpConfig in 4.x, or AddReverseProxy().AddBffExtensions() with MapReverseProxy or MapBffReverseProxy) used to forward the inbound Cookie header, including the BFF session cookie, to the remote API. This happened on every route, including routes that attach an access token. The BFF now removes the Cookie header on all YARP routes, as MapRemoteBffApiEndpoint already did.
If one of your remote APIs relies on receiving cookies through YARP, set the new BffOptions.RemoveCookieHeaderFromYarpRequests option to false, and use YARP transforms to control cookie forwarding per route. Learn more about cookie header removal and how to opt out.