A step-by-step guide to implementing cookie-based authentication in a YARP reverse proxy acting as a Backend for Frontend (BFF) within a .NET Aspire solution. Covers why cookies are more secure than JWT tokens (server-side session storage, HTTP-only, SameSite, HTTPS-only flags), how to configure ASP.NET Core cookie and OpenID Connect authentication schemes with Auth0, and how to create login, logout, and user-info endpoints for the frontend to consume.
Table of contents
Token-based authenticationCookie-based authenticationImplementing cookie-based authentication within a YARP BFFSummary2 Impressions