Secure BFF auth layer as a Keycloak extension
Backend-for-Frontend
A Keycloak realm resource provider that keeps tokens server-side, issues BFF_SESSION cookies, and proxies backend calls.
View on GitHub
mvn clean package && cp target/*.jar $KEYCLOAK_HOME/providers/
Tokens stay server-side
Access and refresh tokens live in the BFF layer, not in localStorage or JavaScript-accessible cookies.
Drop-in Keycloak extension
Deploy as a JAR to providers/, rebuild Keycloak, and call /realms/{realm}/bff/* from your SPA.
Built for SPAs
POST /bff/backend/call forwards authenticated requests to downstream APIs with bearer tokens attached.
Features
- BFF_SESSION HttpOnly cookie — browser never holds access or refresh tokens
- Login, OTP, session check, logout, and backend proxy endpoints
- CSRF validation on browser POST routes via Origin/Referer checks
- Automatic token refresh before downstream API calls
- Demo stack with docker compose