Skip to content
Duende Software Docs
Livestream: Custom Authentication in ASP.NET Core - RemoteAuthenticationHandler with Elin and Robert from Active Solution. Register Now!

BFF Session Management Endpoints

Duende.BFF adds endpoints for performing typical session-management operations such as triggering login and logout and getting information about the currently logged-on user. These endpoint are meant to be called by the frontend.

In addition, Duende.BFF adds an implementation of the OpenID Connect back-channel notification endpoint to overcome the restrictions of third party cookies in front-channel notification in modern browsers.

You enable the endpoints by adding the relevant services into the ASP.NET Core service provider:

Program.cs
// Add BFF services to DI - also add server-side session management
builder.Services.AddBff(options =>
{
    // default value
    options.ManagementBasePath = "/bff";
};

Starting with BFF v4, the BFF automatically wires up the management endpoints. If you disable this behavior (using AutomaticallyRegisterBffMiddleware, this is how you can map the management endpoints:

Program.cs
var app = builder.Build();


// Preprocessing pipeline, which would have been automatically added to start of the request the pipeline.
app.UseBffPreProcessing();


// Your logic, such as:
app.UseRouting();
app.UseBff();


// post processing pipeline that would have been automatically added to the end of the request pipeline.
app.UseBffPostProcessing();


app.Run();

The UsePreprocessing method adds all handling for multiple frontend support. Alternatively, you can call these methods direct:

app.UseBffFrontendSelection();
app.UseBffPathMapping();
app.UseBffOpenIdCallbacks();~

UseBffPostProcessing adds all BFF management endpoints and handlers for proxying index.html. You can also map each endpoint individually by calling the various MapBffManagementXxxEndpoint methods, for example endpoints.MapBffManagementLoginEndpoint().

The following pages describe the default behavior of the management endpoints. See the extensibility section for information about how to customize the behavior of the endpoints.