{"id":16998252,"url":"https://github.com/sangeetagarwal/securingappswithoauth2andoidc","last_synced_at":"2026-05-15T23:12:35.348Z","repository":{"id":193165183,"uuid":"650339898","full_name":"SangeetAgarwal/SecuringAppsWithOAuth2AndOIDC","owner":"SangeetAgarwal","description":"Fully functional App that demonstrate the various flows in OpenId. It uses Duende's Identity Server as the IDP. You'll also see a React app which uses the Backend for Frontend (BFF) pattern to communicate with the API along with a a pure JavaScript client which again uses the BFF pattern to communicate with the API.","archived":false,"fork":false,"pushed_at":"2025-01-26T04:48:42.000Z","size":6058,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-03-18T01:37:48.378Z","etag":null,"topics":["aspnetcore","bff","duende","duende-identityserver","identity","oauth","oidc","openid-connect","security"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SangeetAgarwal.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-06-06T21:33:03.000Z","updated_at":"2024-05-20T21:27:15.000Z","dependencies_parsed_at":"2024-11-28T16:55:40.260Z","dependency_job_id":null,"html_url":"https://github.com/SangeetAgarwal/SecuringAppsWithOAuth2AndOIDC","commit_stats":{"total_commits":23,"total_committers":1,"mean_commits":23.0,"dds":0.0,"last_synced_commit":"089abd39ffacdf686a2e0d7b761ba713a034d1dc"},"previous_names":["sangeetagarwal/securingappswithoauth2andoidc"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SangeetAgarwal%2FSecuringAppsWithOAuth2AndOIDC","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SangeetAgarwal%2FSecuringAppsWithOAuth2AndOIDC/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SangeetAgarwal%2FSecuringAppsWithOAuth2AndOIDC/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SangeetAgarwal%2FSecuringAppsWithOAuth2AndOIDC/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SangeetAgarwal","download_url":"https://codeload.github.com/SangeetAgarwal/SecuringAppsWithOAuth2AndOIDC/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244920448,"owners_count":20532035,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aspnetcore","bff","duende","duende-identityserver","identity","oauth","oidc","openid-connect","security"],"created_at":"2024-10-14T04:04:42.341Z","updated_at":"2026-05-15T23:12:30.328Z","avatar_url":"https://github.com/SangeetAgarwal.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n  \u003ch1 align=\"center\"\u003eWorking app that demonstrates the various flows in OpenId 🚀\u003c/a\u003e\u003c/h1\u003e\n  \u003cp align=\"left\"\u003e\n    This repository uses an MVC app which then communicates with an API to demonstrate the various flows in OpenId. It uses Duende's Identity Server as the IDP. You'll also see a React app which uses the Backend for Frontend (BFF) pattern to communicate with the API along with a a pure Javascript client which again uses the BFF pattern to communicate with the API.\n  \u003c/p\u003e\n\u003cp align=\"left\"\u003e\n \n\u003c/p\u003e\n\u003c/div\u003e\n\n## Setup\n\n1.  Clone the repository.\n2.  Open the solution in Visual Studio and ensure that `Multiple startup projects` radio button is selected and that all the projects have the `Start` action.\n3.  The user dB database must be created and seeded. To do this, open the Package Manager Console and ensure that the default project is set to `MakeBitByte.IDP`.\n    Then run the following command - `update-database -Context UserDbContext`\n\nThis will create the database and seed it with the default users.\nThe default users are:\n\n- `appa` with password `P@ssw0rd`\n- `arjun` with password `P@ssw0rd`\n- `vinita` with password `P@ssw0rd`\n\n## Auth code with PKCE flow\n\nFor this, go to the `NoteController` in the `Notes.MvcApp` project and uncomment the `[Authorize]` attribute. This should be the only `Authorize` attribute that should be uncommented. This will then cause the `.AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =\u003e { ... })` to be called.\n\nAlso, ensure that the default challege scheme in the `program.cs` file of the `Notes.MvcApp` is set to ` options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme` within the `builder.Services.AddAuthentication(options =\u003e { ... })` method. This will ensure that the `.AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =\u003e { ... })` handler is used for the challenge.\n\n## Authentication with Private Key JWT\n\nFor this, go to the `NoteController` in the `Notes.MvcApp` project and uncomment the `[Authorize(AuthenticationSchemes = \"CodeFlowWithPrivateKeyJWTScheme\")]` attribute. This should be the only `Authorize` attribute that should be uncommented. This will then cause the `.AddOpenIdConnect(\"CodeFlowWithPrivateKeyJWTScheme\", options =\u003e { ... })` to be called.\n\nAlso, ensure that the default challege scheme in the `program.cs` file of the `Notes.MvcApp` is set to `options.DefaultChallengeScheme = \"CodeFlowWithPrivateKeyJWTScheme\"` within the `builder.Services.AddAuthentication(options =\u003e { ... })` method. This will ensure that this time the `.AddOpenIdConnect(\"CodeFlowWithPrivateKeyJWTScheme\", options =\u003e { ... })` handler is used for the challenge.\n\n## JAR or JWT secured authorization request with client secret\n\nFor this, go to the `NoteController` in the `Notes.MvcApp` project and uncomment the `[Authorize(AuthenticationSchemes = \"CodeFlowWithJARScheme\")]` attribute. This should be the only `Authorize` attribute that should be uncommented. This will then cause the `.AddOpenIdConnect(\"CodeFlowWithJARScheme\", options =\u003e { ... })` to be called.\n\nAs before you'll want to make sure the corresponding default challenge scheme is set to `CodeFlowWithJARScheme` in the `program.cs` file of the `Notes.MvcApp` project.\n\n## Token encrypted code flow\n\nAs before, you'll only want to uncomment `[Authorize(AuthenticationSchemes = \"CodeFlowWithTokenEncryptionScheme\")]` in the `NoteController` in the `Notes.MvcApp` project. This will then cause the `.AddOpenIdConnect(\"CodeFlowWithTokenEncryptionScheme\", options =\u003e { ... })` to be called.\n\nYou'll also want to make sure the corresponding default challenge scheme is set to `CodeFlowWithTokenEncryptionScheme` in the `program.cs` file of the `Notes.MvcApp` project.\n\nAlso, make sure `builder.Services.AddTransient\u003cITokenCreationService, EncryptedTokenCreationService\u003e()` is uncommented in the `HostingExtensions.cs` file of the `MakeBitByte.IDP` project.\n\n## Demonstrate proof of possession (DPoP)\n\nAs before, you'll only want to uncomment `[Authorize(AuthenticationSchemes = \"CodeFlowWithDPoPScheme\")]` in the `NoteController` in the `Notes.MvcApp` project. This will then cause the `.AddOpenIdConnect(\"CodeFlowWithDPoPScheme\", options =\u003e { ... })` to be called. The corresponding challenge scheme should be set to `CodeFlowWithDPoPScheme` in the `program.cs` file of the `Notes.MvcApp` project.\n\nMake sure `builder.Services.ConfigureDPoPTokensForScheme(JwtBearerDefaults.AuthenticationScheme)` in the `program.cs` file of the `Notes.API` project is uncommented.\n\nYou'll also want to uncomment the following lines of code in the `NoteController` for all the actions. This will ensure that the DPoP token is validated. You'll find the `NoteController` in the `Notes.API` project.\n\n```csharp\n  var proofToken = Request.GetDPoPProofToken();\n  if (proofToken == null) return BadRequest();\n```\n\n## Backend for Frontend (BFF) pattern\n\nNavigate to the `ReactClientApp` folder and then `npm install` followed by `npm run dev`\nYou should now be able to login and see the notes being retuned from the API.\n\nAdded a [blog post](https://www.makebitbyte.com/blog/secure-spa-react-bff-duende) which explains how the BFF pattern works while securing a react front end app.\n\n\nhttps://github.com/SangeetAgarwal/SecuringAppsWithOAuth2AndOIDC/assets/2169707/6754a1f6-80e9-4908-8429-6035a4ac4fd8\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsangeetagarwal%2Fsecuringappswithoauth2andoidc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsangeetagarwal%2Fsecuringappswithoauth2andoidc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsangeetagarwal%2Fsecuringappswithoauth2andoidc/lists"}