blazor-bff-patterns

Extract the access token from the server-side cookie session and attach it as a Bearer header using YARP request transforms or an AccessTokenForwardingHandler. Never expose tokens to WebAssembly or browser storage.

Proxy /api/* routes through YARP from the Blazor BFF to the API, attaching Bearer tokens server-side and forwarding X-Tenant-Slug and X-Setup-Secret headers when authoritative hints exist. Map Blazor routes before proxy catch-all routes.

HttpContext is unavailable during SignalR circuit execution in InteractiveServer mode. Use a scoped token cache service that captures the token during the initial HTTP request and provides it to HttpClient handlers for the circuit lifetime.

No. WASM components should call the BFF base address using cookie authentication with a 401 redirect handler. All API calls flow through the BFF, which attaches tokens server-side, keeping the browser free of raw access tokens.

Wrap NSwag clients behind service interfaces, catch ApiException, and return safe defaults like empty collections or null. Log warnings at the service layer and let the auth layer handle 401/403 redirects rather than throwing to UI components.