--- title: Bind Microsoft Foundry agent conversations to... description: A Backend for Frontend pattern limits browsers from reusing a Microsoft Foundry Responses conversation identifier. Instead of sending a raw provider response... canonical: https://daily.dev/posts/bind-microsoft-foundry-agent-conversations-to-authenticated-users-with-a-bff-az6xmckxu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Bind Microsoft Foundry agent conversations to authenticated users with a BFF | daily.dev og:description: A Backend for Frontend pattern limits browsers from reusing a Microsoft Foundry Responses conversation identifier. Instead of sending a raw provider response... og:url: https://daily.dev/posts/bind-microsoft-foundry-agent-conversations-to-authenticated-users-with-a-bff-az6xmckxu og:image: https://api.daily.dev/og/posts/AZ6xMcKXu.png og:image:alt: Bind Microsoft Foundry agent conversations to authenticated users with a BFF og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Bind Microsoft Foundry agent conversations to authenticated users with a BFF **[C\# Corner](https://daily.dev/sources/csharpcorner)** · 9 min read · 1 upvotes · 0 comments ## Summary A Backend for Frontend pattern limits browsers from reusing a Microsoft Foundry Responses conversation identifier. Instead of sending a raw provider response ID, the browser receives a signed continuation token bound to the authenticated user's subject, the upstream mode, and the agent endpoint. The BFF signs this with HMAC-SHA256 and rejects a raw previous_response_id or agent_session_id sent by the browser. Tokens are issued only after a response completes, not just when visible text streams in. A local offline test run covering the continuation and Responses modules passed 51 tests, with seven telemetry tests deselected. The example comes from a banking-assistant prototype that extends Microsoft's public banking-assistant sample. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I prevent one user from continuing another user's conversation when using previous_response_id in Microsoft Foundry's Responses API? Issue a signed continuation token from a Backend for Frontend instead of exposing the raw previous_response_id to the browser. The token is signed with HMAC-SHA256 and binds the response identifier to the authenticated user's subject, the upstream mode (local or Foundry), and the configured agent endpoint, so a token copied by another user fails validation. _Developers securing multi-turn AI agent chat can track patterns like this BFF token design on daily.dev._ ### What should a BFF do if an SSE stream ends without a clear completion signal before issuing a conversation continuation token? It should not issue a new continuation token. If iteration ends normally with a successful HTTP status but no confirmed completion, the BFF emits a CONTINUATION_UNAVAILABLE event with allow_retry set to false. Transport exceptions or non-success HTTP responses also skip that control event entirely, avoiding a token tied to an uncertain or unfinished response. _Teams building streaming agent backends can follow practical reliability patterns like this on daily.dev._ ### Why shouldn't I rely on Base64URL encoding alone to protect a provider's response identifier in a conversation token? Base64URL encoding is not encryption, so the response identifier inside the token is not secret, and provider output may expose identifiers elsewhere anyway. The actual protection comes from refusing to accept any raw identifier as sufficient authority from the browser, requiring a valid HMAC-SHA256 signature tied to the user and destination instead. _Engineers hardening token-based API auth can keep up with these design trade-offs on daily.dev._ ## Similar posts on daily.dev - [Keep Azure Foundry Hosted Agent credentials out of the browser with a BFF \(Backend for Frontend\)](https://daily.dev/posts/keep-azure-foundry-hosted-agent-credentials-out-of-the-browser-with-a-bff-backend-for-frontend--jqarvgb46) · C\# Corner · 0 upvotes · 0 comments - [Proactive messaging, reactions, and compute pooling with Microsoft Foundry hosted agents](https://daily.dev/posts/proactive-messaging-reactions-and-compute-pooling-with-microsoft-foundry-hosted-agents-nl3b8g2ea) · Scott Logic · 1 upvotes · 0 comments - [Medium](https://daily.dev/posts/medium-s2gtxyizj) · Medium · 1 upvotes · 0 comments - [Foundry hosted agent isolation with Microsoft Agent Framework](https://daily.dev/posts/foundry-hosted-agent-isolation-with-microsoft-agent-framework-ot6je35xm) · DevBlogs · 1 upvotes · 0 comments --- Tags: [#python](https://daily.dev/tags/python), [#ai-agents](https://daily.dev/tags/ai-agents), [#authentication](https://daily.dev/tags/authentication) [View this post on daily.dev](https://daily.dev/posts/bind-microsoft-foundry-agent-conversations-to-authenticated-users-with-a-bff-az6xmckxu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Bind Microsoft Foundry agent conversations to authenticated users with a BFF","url":"https://daily.dev/posts/bind-microsoft-foundry-agent-conversations-to-authenticated-users-with-a-bff-az6xmckxu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/bind-microsoft-foundry-agent-conversations-to-authenticated-users-with-a-bff-az6xmckxu"},"datePublished":"2026-10-20T21:42:15.927Z","dateModified":"2026-10-20T22:42:12.979Z","description":"A Backend for Frontend pattern limits browsers from reusing a Microsoft Foundry Responses conversation identifier. Instead of sending a raw provider response...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/261c49ef69d851f357764965e31c53b8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/261c49ef69d851f357764965e31c53b8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"C# Corner","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"C# Corner","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ada2d584df6241748fc4e71878dc70a3","url":"https://daily.dev/sources/csharpcorner"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/bind-microsoft-foundry-agent-conversations-to-authenticated-users-with-a-bff-az6xmckxu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"python,ai-agents,authentication","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"C# Corner","item":"https://daily.dev/sources/csharpcorner"},{"@type":"ListItem","position":3,"name":"Bind Microsoft Foundry agent conversations to authenticated users with a BFF"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/bind-microsoft-foundry-agent-conversations-to-authenticated-users-with-a-bff-az6xmckxu#faq","mainEntity":[{"@type":"Question","name":"How do I prevent one user from continuing another user's conversation when using previous_response_id in Microsoft Foundry's Responses API?","acceptedAnswer":{"@type":"Answer","text":"Issue a signed continuation token from a Backend for Frontend instead of exposing the raw previous_response_id to the browser. The token is signed with HMAC-SHA256 and binds the response identifier to the authenticated user's subject, the upstream mode (local or Foundry), and the configured agent endpoint, so a token copied by another user fails validation. Developers securing multi-turn AI agent chat can track patterns like this BFF token design on daily.dev."}},{"@type":"Question","name":"What should a BFF do if an SSE stream ends without a clear completion signal before issuing a conversation continuation token?","acceptedAnswer":{"@type":"Answer","text":"It should not issue a new continuation token. If iteration ends normally with a successful HTTP status but no confirmed completion, the BFF emits a CONTINUATION_UNAVAILABLE event with allow_retry set to false. Transport exceptions or non-success HTTP responses also skip that control event entirely, avoiding a token tied to an uncertain or unfinished response. Teams building streaming agent backends can follow practical reliability patterns like this on daily.dev."}},{"@type":"Question","name":"Why shouldn't I rely on Base64URL encoding alone to protect a provider's response identifier in a conversation token?","acceptedAnswer":{"@type":"Answer","text":"Base64URL encoding is not encryption, so the response identifier inside the token is not secret, and provider output may expose identifiers elsewhere anyway. The actual protection comes from refusing to accept any raw identifier as sufficient authority from the browser, requiring a valid HMAC-SHA256 signature tied to the user and destination instead. Engineers hardening token-based API auth can keep up with these design trade-offs on daily.dev."}}]} ```