Load for Blazor/MudBlazor UI changes involving forms, dialogs, focus, keyboard navigation, landmarks, ARIA, color contrast, RTL-safe styling, or WCAG 2.2 AA tests; not for backend-only changes.
中文简介正在准备中。当前显示原文说明。
islamu-ngo/Event82026年10月19日 更新
免费在 GitHub 公开
blazor-bff-patterns
Load for Blazor BFF server work involving YARP proxy routes, cookie sessions, access-token forwarding/refresh, downstream API calls, BFF handlers, or browser-to-API auth failures; not for client component rendering or API JWT validation alone.
中文简介正在准备中。当前显示原文说明。
查看安装方法包含的文件（6）
- SKILL.md2.5 KB
- resources/auth-state-management.md515 B
- resources/bff-configuration.md689 B
- resources/interactiveauto-yarp-security.md1.6 KB
- resources/service-layer-patterns.md2.4 KB
- resources/token-forwarding.md2.5 KB
SKILL.md（原文）
安装前可以查看交给 AI 代理的指令内容。
ABOUTME: Blazor BFF rules for YARP, token forwarding, and auth state. ABOUTME: Read referenced resources before applying.
Blazor BFF (Backend for Frontend) Patterns
Project-Agnostic BFF Patterns for Blazor Web Apps (InteractiveAuto)
Placeholders use
{Placeholder}syntax - see docs/internal/TEMPLATE_GLOSSARY.md.
Non‑Inferable Rules (Must Follow)
- BFF boundary: Browser never sees tokens; BFF uses HttpOnly cookies.
- YARP: API calls go through reverse proxy; attach Bearer token server-side.
- Token forwarding: Use YARP transforms or delegating handlers (no raw HttpClient in WASM).
- YARP header transforms:
X-Setup-Secretis stripped from inbound requests and replaced by the BFF from secure config.X-Tenant-Slugis forwarded when the BFF has an authoritative tenant hint. - Service layer: Wrap NSwag clients for error handling + safe defaults.
- CSRF: Enforce antiforgery on state‑changing routes.
- InteractiveAuto: Avoid direct HttpContext assumptions in components.
- CORS: API CORS policy names are environment-specific to this repo (
InternalAppPolicy,ExternalAppPolicy,InternalWebsitePolicy,ExternalWebsitePolicy,DevPolicy). Do not copy placeholder policy names from generic BFF examples into this codebase. - Tenant resolution: The API resolves tenant identity from trusted
X-Tenant-Slugfirst, then normalizedRequest.Host.Hostafter forwarded-header processing. API-key flows are split: pre-auth middleware may record a requested tenant hint, and post-auth middleware finalizes binding or fails closed.
Resources (Read Before Applying)
- bff-configuration.md
- token-forwarding.md
- auth-state-management.md
- service-layer-patterns.md
- interactiveauto-yarp-security.md
Related Documentation
评价
还没有评价。欢迎分享你的使用感受。
评论
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
同一仓库的技能
Load when a task asks to research, verify, compare, or look up framework/package behavior, release notes, standards, RFCs, CVEs, or unfamiliar APIs; use repository evidence first, then official docs, and not for codebase navigation alone.
中文简介正在准备中。当前显示原文说明。
islamu-ngo/Event82026年10月19日 更新
aspire
免费Load for Aspire AppHost work: start/stop/wait resources, inspect dashboard/logs/traces, add integrations/resources, rebuild a service, run isolated worktrees, or diagnose Aspire orchestration; not for plain dotnet apps, container-only deployments, or cloud deployment.
中文简介正在准备中。当前显示原文说明。
islamu-ngo/Event82026年10月19日 更新
Load for authentication or authorization changes involving BFF cookies/tokens, JWT validation, claims/user ID extraction, policies, handler access checks, impersonation, or 401/403 bugs; not for UI affordance gating alone.
中文简介正在准备中。当前显示原文说明。
islamu-ngo/Event82026年10月19日 更新
Load when editing Blazor `.razor.css`, scoped selectors, `::deep`, BEM class names, RTL/logical CSS properties, or styling nested MudBlazor components; not for global design tokens or non-Blazor CSS.
中文简介正在准备中。当前显示原文说明。
islamu-ngo/Event82026年10月19日 更新
Load for Blazor/MudBlazor component or page changes involving render modes, dialogs, parameters/events, HAL-gated actions, generated API clients or generated record consumption, theming, or component tests; add accessibility or CSS-isolation only when touched.
中文简介正在准备中。当前显示原文说明。
islamu-ngo/Event82026年10月19日 更新