The Backend for Frontend (BFF) pattern places a traditional ASP.NET Core application between a SPA and its real APIs. It authenticates users, stores bearer tokens securely, issues an authentication cookie, and forwards authenticated requests. section 25.2
A typical request flow is:
- The user authenticates through OpenID Connect at the ASP.NET Core backend. section 25.2
- The backend stores the bearer tokens and gives the browser an authentication cookie instead. section 25.2
- The SPA sends requests with the cookie; the backend exchanges it for the appropriate bearer token and forwards each request to the real API. section 25.2
SPA without browser-held bearer tokens
A Blazor WebAssembly, React, or Angular frontend calls its ASP.NET Core backend using the authentication cookie. The backend adds the bearer token when calling the protected API, so the browser never receives that token. section 25.2



