ClaudeSuperPower

duende-bff

Skill

Duende BFF (Backend for Frontend) security framework for securing SPAs. Covers session management, API endpoint proxying, token management, anti-forgery protection, and integration with React/Angular/Blazor frontends.

Install

git clone https://github.com/DuendeSoftware/duende-skills.git ~/.claude/skills/duende-bff

What is duende-bff?

Duende BFF (Backend for Frontend) security framework for securing SPAs. Covers session management, API endpoint proxying, token management, anti-forgery protection, and integration with React/Angular/Blazor frontends.

What this can do

Capabilities declared in this component's own frontmatter — not inferred.

Inherit all session tools

Declares no tool restrictions — inherits every session tool

~54 tokens of context used while enabled, before you invoke anything

Documentation

README · ~18 min read

Duende BFF (Backend for Frontend)

When to Use This Skill

  • Building or securing a SPA (React, Angular, Vue, Blazor WASM) that calls APIs requiring authentication
  • Implementing the Backend-for-Frontend security pattern to keep access tokens out of the browser
  • Configuring BFF session management, login/logout endpoints, and server-side sessions
  • Proxying requests from a frontend to remote APIs while automatically attaching access tokens
  • Adding CSRF/anti-forgery protection to APIs consumed by browser-based applications
  • Integrating Duende.BFF with Duende.AccessTokenManagement for automatic token refresh
  • Deploying a BFF behind a reverse proxy or configuring same-site cookie behavior

Core Principles

Reviews

Log in to leave a review.

No reviews yet — be the first.

Explore related

Other things in this space — across every part of the ecosystem, not just skills.