I have implemented Duende BFF auth in already. But I wonder how I can achieve the same using node.js. I have a login site which uses Duende to recieve a cookie for all same-site domains, but my problem is I want to change my other BFF (client -> BFF -> micro services) to be i node.js. I am currently trying to implement the same using openid-client, but I cannot wrap my head around how the flow really is behind the scenes.
These are my services:
id.myapp -> handle all the userSession stuff with verifying the user etc
login.myapp -> handle login, use id.myapp to verify
bff.myapp -> use bffAuth with oidc flow from duende
Client flow:
Client (with cookie) -> read request to BFF which aggregates result from multiple services -> 2x services
I am currently also wondering if this may be secure enough:
Client (with cookie) -> BFF aggregator -> fetch user token from login.myapp -> 2x micro services.
I have implemented Duende BFF auth in already. But I wonder how I can achieve the same using node.js. I have a login site which uses Duende to recieve a cookie for all same-site domains, but my problem is I want to change my other BFF (client -> BFF -> micro services) to be i node.js. I am currently trying to implement the same using openid-client, but I cannot wrap my head around how the flow really is behind the scenes.
These are my services:
id.myapp -> handle all the userSession stuff with verifying the user etc
login.myapp -> handle login, use id.myapp to verify
bff.myapp -> use bffAuth with oidc flow from duende
Client flow:
Client (with cookie) -> read request to BFF which aggregates result from multiple services -> 2x services
I am currently also wondering if this may be secure enough:
Client (with cookie) -> BFF aggregator -> fetch user token from login.myapp -> 2x micro services.
1 Answer
Reset to default 0In general, moving as much of possible of the authentication logic to the backend (BFF) is good! Keep the frontend as simple as possible, only using cookie authentication is best practice.
This is a good video on the topic alert‘OAuth 2 0’; // The impact of XSS on OAuth 2 0 in SPAs