Running BFF and IdentityServer in the same host

[buskyrancho]

Hi team, I need some clarity on this. I have a Blazor Wasm web application, and I also have another asp.net core application hosting Duende IdentityServer which serves as the authentication server for the Blazor Wasm web app. The Blazor Wasm uses the BFF library.

A requirement came from my team lead asking me to combine the two applications into one. So my question is whether it makes sense for the Blazor Wasm host to also host IdentityServer?

[maartenba]

It's not recommended to host the Blazor Wasm app/BFF host and Duende IdentityServer in the same app. IdentityServer is intended for distributed scenarios where the application/client, API and identity provider are on different hosts. IdentityServer also uses the host as the security boundary for cookies, and combining apps would break isolation here.

[buskyrancho]

thanks for your response @maartenba

I thought so as well and I explained this to my colleague but he insist on doing it that way. He thinks there is no technical reason why it is not possible even though it is not recommended as per this link https://docs.duendesoftware.com/identityserver/upgrades/spa_to_duende/.

Is it possible to get list of possible technical dept this might create so I can use that to convince him.

[maartenba]

You'd be mixing security cookies from two applications essentially, which could cause side effects.