diff --git a/samples/JS8/wwwroot/libs/bootstrap.min.css b/samples/Bff/wwwroot/libs/bootstrap.min.css
similarity index 100%
rename from samples/JS8/wwwroot/libs/bootstrap.min.css
rename to samples/Bff/wwwroot/libs/bootstrap.min.css
diff --git a/samples/JS8/wwwroot/libs/bootstrap.min.js b/samples/Bff/wwwroot/libs/bootstrap.min.js
similarity index 100%
rename from samples/JS8/wwwroot/libs/bootstrap.min.js
rename to samples/Bff/wwwroot/libs/bootstrap.min.js
diff --git a/samples/JS8.EF/wwwroot/todo.html b/samples/Bff/wwwroot/todo.html
similarity index 100%
rename from samples/JS8.EF/wwwroot/todo.html
rename to samples/Bff/wwwroot/todo.html
diff --git a/samples/JS8.EF/wwwroot/todo.js b/samples/Bff/wwwroot/todo.js
similarity index 100%
rename from samples/JS8.EF/wwwroot/todo.js
rename to samples/Bff/wwwroot/todo.js
diff --git a/samples/Blazor.Wasm/Blazor.Wasm.Bff/Program.cs b/samples/Blazor.Wasm/Blazor.Wasm.Bff/Program.cs
index 38ffd3eb..c87b49c8 100644
--- a/samples/Blazor.Wasm/Blazor.Wasm.Bff/Program.cs
+++ b/samples/Blazor.Wasm/Blazor.Wasm.Bff/Program.cs
@@ -27,7 +27,7 @@
options.Authority = "https://localhost:5001";
// confidential client using code flow + PKCE
- options.ClientId = "spa";
+ options.ClientId = "bff";
options.ClientSecret = "secret";
options.ResponseType = "code";
options.ResponseMode = "query";
diff --git a/samples/IdentityServer/Config.cs b/samples/IdentityServer/Config.cs
index 17c843be..7cf68b4e 100644
--- a/samples/IdentityServer/Config.cs
+++ b/samples/IdentityServer/Config.cs
@@ -10,35 +10,31 @@ namespace IdentityServerHost
public static class Config
{
public static IEnumerable
IdentityResources =>
- new IdentityResource[]
- {
+ [
new IdentityResources.OpenId(),
new IdentityResources.Profile(),
- };
+ ];
public static IEnumerable ApiScopes =>
- new ApiScope[]
- {
- new ApiScope("api", new[] { "name" }),
- new ApiScope("scope-for-isolated-api", new[] { "name" }),
- };
+ [
+ new ApiScope("api", ["name"]),
+ new ApiScope("scope-for-isolated-api", ["name"]),
+ ];
public static IEnumerable ApiResources =>
- new ApiResource[]
- {
+ [
new ApiResource("urn:isolated-api", "isolated api")
{
RequireResourceIndicator = true,
Scopes = { "scope-for-isolated-api" }
}
- };
+ ];
public static IEnumerable Clients =>
- new Client[]
- {
+ [
new Client
{
- ClientId = "spa",
+ ClientId = "bff",
ClientSecrets = { new Secret("secret".Sha256()) },
AllowedGrantTypes =
@@ -54,13 +50,15 @@ public static class Config
AllowOfflineAccess = true,
AllowedScopes = { "openid", "profile", "api", "scope-for-isolated-api" },
- },
+ AccessTokenLifetime = 75 // Force refresh
+ },
new Client
{
- ClientId = "backchannel-spa",
+ ClientId = "bff.dpop",
ClientSecrets = { new Secret("secret".Sha256()) },
-
+ RequireDPoP = true,
+
AllowedGrantTypes =
{
GrantType.AuthorizationCode,
@@ -69,12 +67,34 @@ public static class Config
},
RedirectUris = { "https://localhost:5003/signin-oidc" },
- BackChannelLogoutUri = "https://localhost:5003/bff/backchannel",
+ FrontChannelLogoutUri = "https://localhost:5003/signout-oidc",
PostLogoutRedirectUris = { "https://localhost:5003/signout-callback-oidc" },
AllowOfflineAccess = true,
AllowedScopes = { "openid", "profile", "api", "scope-for-isolated-api" },
+
+ AccessTokenLifetime = 75 // Force refresh
},
- };
+ new Client
+ {
+ ClientId = "bff.ef",
+ ClientSecrets = { new Secret("secret".Sha256()) },
+
+ AllowedGrantTypes =
+ {
+ GrantType.AuthorizationCode,
+ GrantType.ClientCredentials,
+ OidcConstants.GrantTypes.TokenExchange
+ },
+ RedirectUris = { "https://localhost:5004/signin-oidc" },
+ BackChannelLogoutUri = "https://localhost:5004/bff/backchannel",
+ PostLogoutRedirectUris = { "https://localhost:5004/signout-callback-oidc" },
+
+ AllowOfflineAccess = true,
+ AllowedScopes = { "openid", "profile", "api", "scope-for-isolated-api" },
+
+ AccessTokenLifetime = 75 // Force refresh
+ }
+ ];
}
}
\ No newline at end of file
diff --git a/samples/JS.Yarp/JS.Yarp.csproj b/samples/JS.Yarp/JS.Yarp.csproj
deleted file mode 100644
index 7dbe7ab2..00000000
--- a/samples/JS.Yarp/JS.Yarp.csproj
+++ /dev/null
@@ -1,17 +0,0 @@
-
-
-
- net8.0
- YARP
-
-
-
-
-
-
-
-
-
-
-
-
diff --git a/samples/JS.Yarp/LocalApiController.cs b/samples/JS.Yarp/LocalApiController.cs
deleted file mode 100644
index 06976682..00000000
--- a/samples/JS.Yarp/LocalApiController.cs
+++ /dev/null
@@ -1,23 +0,0 @@
-// Copyright (c) Duende Software. All rights reserved.
-// See LICENSE in the project root for license information.
-
-using Microsoft.AspNetCore.Mvc;
-
-namespace YarpHost
-{
- [Route("local")]
- //[BffApi]
- public class LocalApiController : ControllerBase
- {
- public IActionResult Get()
- {
- var data = new
- {
- Message = "Hello from local API",
- User = User.FindFirst("name")?.Value ?? User.FindFirst("sub").Value
- };
-
- return Ok(data);
- }
- }
-}
\ No newline at end of file
diff --git a/samples/JS.Yarp/Program.cs b/samples/JS.Yarp/Program.cs
deleted file mode 100644
index f09082b9..00000000
--- a/samples/JS.Yarp/Program.cs
+++ /dev/null
@@ -1,55 +0,0 @@
-// Copyright (c) Duende Software. All rights reserved.
-// See LICENSE in the project root for license information.
-
-using System;
-using Microsoft.AspNetCore.Hosting;
-using Microsoft.Extensions.Hosting;
-using Serilog;
-using Serilog.Events;
-using Serilog.Sinks.SystemConsole.Themes;
-
-namespace YarpHost
-{
- public class Program
- {
- public static int Main(string[] args)
- {
- Log.Logger = new LoggerConfiguration()
- .MinimumLevel.Information()
- .MinimumLevel.Override("Microsoft", LogEventLevel.Warning)
- .MinimumLevel.Override("Microsoft.Hosting.Lifetime", LogEventLevel.Information)
- .MinimumLevel.Override("Microsoft.AspNetCore.Authentication", LogEventLevel.Information)
- .MinimumLevel.Override("IdentityModel", LogEventLevel.Debug)
- .MinimumLevel.Override("Duende.Bff", LogEventLevel.Debug)
- .Enrich.FromLogContext()
- .WriteTo.Console(outputTemplate: "[{Timestamp:HH:mm:ss} {Level}] {SourceContext}{NewLine}{Message:lj}{NewLine}{Exception}{NewLine}", theme: AnsiConsoleTheme.Code)
- .CreateLogger();
-
- try
- {
- Log.Information("Starting host...");
- CreateHostBuilder(args).Build().Run();
- return 0;
- }
- catch (Exception ex)
- {
- Log.Fatal(ex, "Host terminated unexpectedly.");
- return 1;
- }
- finally
- {
- Log.CloseAndFlush();
- }
- }
-
- public static IHostBuilder CreateHostBuilder(string[] args)
- {
- return Host.CreateDefaultBuilder(args)
- .UseSerilog()
- .ConfigureWebHostDefaults(webBuilder =>
- {
- webBuilder.UseStartup();
- });
- }
- }
-}
\ No newline at end of file
diff --git a/samples/JS.Yarp/Startup.cs b/samples/JS.Yarp/Startup.cs
deleted file mode 100644
index 8ca4bcc1..00000000
--- a/samples/JS.Yarp/Startup.cs
+++ /dev/null
@@ -1,166 +0,0 @@
-// Copyright (c) Duende Software. All rights reserved.
-// See LICENSE in the project root for license information.
-
-using System;
-using System.Collections.Generic;
-using Duende.Bff;
-using Duende.Bff.Yarp;
-using Microsoft.AspNetCore.Builder;
-using Microsoft.AspNetCore.Http;
-using Microsoft.Extensions.DependencyInjection;
-using Serilog;
-using Yarp.ReverseProxy.Configuration;
-
-namespace YarpHost
-{
- public class Startup
- {
- public void ConfigureServices(IServiceCollection services)
- {
- var builder = services.AddReverseProxy()
- .AddBffExtensions();
-
- builder.LoadFromMemory(
- new[]
- {
- new RouteConfig()
- {
- RouteId = "api_user",
- ClusterId = "cluster1",
-
- Match = new()
- {
- Path = "/user_api/{**catch-all}"
- }
- }.WithAccessToken(TokenType.User).WithAntiforgeryCheck(),
- new RouteConfig()
- {
- RouteId = "api_client",
- ClusterId = "cluster1",
-
- Match = new()
- {
- Path = "/client_api/{**catch-all}"
- }
- }.WithAccessToken(TokenType.Client).WithAntiforgeryCheck(),
- new RouteConfig()
- {
- RouteId = "api_anon",
- ClusterId = "cluster1",
-
- Match = new()
- {
- Path = "/anon_api/{**catch-all}"
- }
- }.WithAntiforgeryCheck(),
- new RouteConfig()
- {
- RouteId = "api_optional_user",
- ClusterId = "cluster1",
-
- Match = new()
- {
- Path = "/optional_user_api/{**catch-all}"
- }
- }.WithOptionalUserAccessToken().WithAntiforgeryCheck()
- },
- new[]
- {
- new ClusterConfig
- {
- ClusterId = "cluster1",
-
- Destinations = new Dictionary(StringComparer.OrdinalIgnoreCase)
- {
- { "destination1", new() { Address = "https://localhost:5010" } },
- }
- }
- });
-
-
- // Add BFF services to DI - also add server-side session management
- services.AddBff()
- .AddServerSideSessions();
-
- // local APIs
- services.AddControllers();
-
- // cookie options
- services.AddAuthentication(options =>
- {
- options.DefaultScheme = "cookie";
- options.DefaultChallengeScheme = "oidc";
- options.DefaultSignOutScheme = "oidc";
- })
- .AddCookie("cookie", options =>
- {
- // set session lifetime
- options.ExpireTimeSpan = TimeSpan.FromHours(8);
-
- // sliding or absolute
- options.SlidingExpiration = false;
-
- // host prefixed cookie name
- options.Cookie.Name = "__Host-spa-yarp";
-
- // strict SameSite handling
- options.Cookie.SameSite = SameSiteMode.Strict;
- })
- .AddOpenIdConnect("oidc", options =>
- {
- options.Authority = "https://localhost:5001";
-
- // confidential client using code flow + PKCE
- options.ClientId = "spa";
- options.ClientSecret = "secret";
- options.ResponseType = "code";
- options.ResponseMode = "query";
-
- options.MapInboundClaims = false;
- options.GetClaimsFromUserInfoEndpoint = true;
- options.SaveTokens = true;
-
- // request scopes + refresh tokens
- options.Scope.Clear();
- options.Scope.Add("openid");
- options.Scope.Add("profile");
- options.Scope.Add("api");
- options.Scope.Add("offline_access");
- });
- }
-
- public void Configure(IApplicationBuilder app)
- {
- app.UseSerilogRequestLogging();
- app.UseDeveloperExceptionPage();
-
- app.UseDefaultFiles();
- app.UseStaticFiles();
-
- app.UseAuthentication();
- app.UseRouting();
-
- // adds antiforgery protection for local APIs
- app.UseBff();
-
- // adds authorization for local and remote API endpoints
- app.UseAuthorization();
-
- app.UseEndpoints(endpoints =>
- {
- // local APIs
- endpoints.MapControllers()
- .RequireAuthorization()
- .AsBffApiEndpoint();
-
- // login, logout, user, backchannel logout...
- endpoints.MapBffManagementEndpoints();
-
- endpoints.MapReverseProxy(proxyApp =>
- {
- proxyApp.UseAntiforgeryCheck();
- });
- });
- }
- }
-}
\ No newline at end of file
diff --git a/samples/JS.Yarp/wwwroot/app.js b/samples/JS.Yarp/wwwroot/app.js
deleted file mode 100644
index e6d16062..00000000
--- a/samples/JS.Yarp/wwwroot/app.js
+++ /dev/null
@@ -1,148 +0,0 @@
-const loginUrl = "/bff/login";
-const userUrl = "/bff/user";
-let logoutUrl = "/bff/logout";
-
-async function onLoad() {
- var req = new Request(userUrl, {
- headers: new Headers({
- 'X-CSRF': '1'
- })
- })
-
- try {
- var resp = await fetch(req);
- if (resp.ok) {
- log("user logged in");
-
- let claims = await resp.json();
- showUser(claims);
-
- let logoutUrlClaim = claims.find(claim => claim.type === 'bff:logout_url');
- if (logoutUrlClaim) {
- logoutUrl = logoutUrlClaim.value;
- }
- } else if (resp.status === 401) {
- log("user not logged in");
- }
- }
- catch (e) {
- log("error checking user status");
- }
-}
-
-onLoad();
-
-function login() {
- window.location = loginUrl;
-}
-
-function logout() {
- window.location = logoutUrl;
-}
-
-async function callUserToken() {
- var req = new Request("/user_api", {
- headers: new Headers({
- 'X-CSRF': '1'
- })
- })
- var resp = await fetch(req);
-
- log("API Result: " + resp.status);
- if (resp.ok) {
- showApi(await resp.json());
- }
-}
-
-async function callOptionalUserToken() {
- var req = new Request("/optional_user_api", {
- headers: new Headers({
- 'X-CSRF': '1'
- })
- })
- var resp = await fetch(req);
-
- log("API Result: " + resp.status);
- if (resp.ok) {
- showApi(await resp.json());
- }
-}
-
-async function callClientToken() {
- var req = new Request("/client_api", {
- headers: new Headers({
- 'X-CSRF': '1'
- })
- })
- var resp = await fetch(req);
-
- log("API Result: " + resp.status);
- if (resp.ok) {
- showApi(await resp.json());
- }
-}
-
-async function callNoToken() {
- var req = new Request("/anon_api", {
- headers: new Headers({
- 'X-CSRF': '1'
- })
- })
- var resp = await fetch(req);
-
- log("API Result: " + resp.status);
- if (resp.ok) {
- showApi(await resp.json());
- }
-}
-
-
-
-document.querySelector(".login").addEventListener("click", login, false);
-document.querySelector(".logout").addEventListener("click", logout, false);
-
-document.querySelector(".call_user").addEventListener("click", callUserToken, false);
-document.querySelector(".call_optional_user").addEventListener("click", callOptionalUserToken, false);
-document.querySelector(".call_client").addEventListener("click", callClientToken, false);
-document.querySelector(".call_anon").addEventListener("click", callNoToken, false);
-
-
-
-function showApi() {
- document.getElementById('api-result').innerText = '';
-
- Array.prototype.forEach.call(arguments, function (msg) {
- if (msg instanceof Error) {
- msg = "Error: " + msg.message;
- } else if (typeof msg !== 'string') {
- msg = JSON.stringify(msg, null, 2);
- }
- document.getElementById('api-result').innerText += msg + '\r\n';
- });
-}
-
-function showUser() {
- document.getElementById('user').innerText = '';
-
- Array.prototype.forEach.call(arguments, function (msg) {
- if (msg instanceof Error) {
- msg = "Error: " + msg.message;
- } else if (typeof msg !== 'string') {
- msg = JSON.stringify(msg, null, 2);
- }
- document.getElementById('user').innerText += msg + '\r\n';
- });
-}
-
-function log() {
- document.getElementById('response').innerText = '';
-
- Array.prototype.forEach.call(arguments, function (msg) {
- if (msg instanceof Error) {
- msg = "Error: " + msg.message;
- } else if (typeof msg !== 'string') {
- msg = JSON.stringify(msg, null, 2);
- }
- document.getElementById('response').innerText += msg + '\r\n';
- });
-}
diff --git a/samples/JS.Yarp/wwwroot/index.html b/samples/JS.Yarp/wwwroot/index.html
deleted file mode 100644
index 9d9b2057..00000000
--- a/samples/JS.Yarp/wwwroot/index.html
+++ /dev/null
@@ -1,63 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- |
- Id |
- Date |
- Note |
- User |
-
-
-
-
-
-