Backend for Frontend for ASP.NET Core Authentication 

Great video, i feel authentication is the Achilles Heel for a lot of developers, SPAs are great but should not be looking after access/identity tokens as its just not secure.

oHey Great video, did you create a github for this coding tutorial?

Please consider making a video on how to merge this tutorial with Blazor Webassembly Hosted App. Thanks!

If I understood correctly, this pattern means that even if an SPA can authenticate directly by calling the OAuth endpoint, for example when using Auth0, the best practice is to do this only through the backend, or is it something else ?

Awesome, thank you

Yo Yo not everybody is like you smart ad intelligent. Too fast bit bouncy over all your content. Thanks for sharing.

How do you redirect to youtube from your view frontend? Does the connect-youtube endpoint send back a redirect url with oidc params?

hi please share a a video for creating 'SSO' and do that just with pure C# code, I mean don't use Identity Server or etc. Teach this tech with pure code. thanks

Awesome

Do you have an example where we are using google for authentication?

Do you think using Distributed cache in Db is good way to store token against cookie ?

Dotwatch ? . Where can I get the CLI ?

Hi Very good video. Three question. In a monolith app with no external authentication, just on the same server authentication. Q1. Is storing a token in local storage a bad practice from security point of view, even if we are doing an Api call same server and not on some external server like youtube, facebook ? Q2. If we are hitting apis only on our server, is authenticating a user with username and password is flawed ?. I mean is OpenId Connect still a best practice or it is over kill. Q3. With BFF when using refresh token to get an access token. Is middleware a best play to implement this ? What i understand from your BFF video, is token is stored at backend and with frontend only a small is cookie, that could contain a user-id. And then each an Api is called, we grab the token against that user-Id, populate the ClaimsPrincipal and complete an Api either external or on same server. Thank you again. I'm learning a lot from you Sensi :).

I tried the fetch thing but it does not redirect to google

Привет Антон. сам откуда?)