A practical guide on integrating an Angular SPA with a Duende Backend For Frontend (BFF) to improve security. Covers the shift from the Implicit flow (token stored in browser) to the PKCE flow handled server-side, how to add an anti-forgery X-CSRF header via an Angular HTTP interceptor, setting up a local proxy to forward requests to the BFF, and using Duende's built-in /bff/login and /bff/user endpoints. The result is a simpler frontend with less authentication code and improved security through server-side session management.
