# Configuration Options

> Comprehensive guide to configuring Duende BFF framework including general settings, paths, session management, and API options

The *Duende.BFF.BffOptions* allows to configure several aspects of the BFF framework.

You set the options at startup time:

```csharp
builder.Services.AddBff(options =>
{
    // configure options here...
})
```

## General

[Section titled âGeneralâ](#general)

* ***EnforceBffMiddleware***

  Enables checks in the user management endpoints that ensure that the BFF middleware has been added to the pipeline. Since the middleware performs important security checks, this protects from accidental configuration errors. You can disable this check if it interferes with some custom logic you might have. Defaults to true.

* ***LicenseKey***

  This sets the license key for Duende.BFF. A business edition or higher license key is required for production deployments. The same license key is used in IdentityServer and the BFF. Just as in the [IdentityServer host](/general/licensing/), you can either set the license key using this option in code or include *Duende\_License.key* in the same directory as your BFF host.

* ***AnonymousSessionResponse*** (added in 2.0)

  This sets the response status code behavior on the [user endpoint](/bff/fundamentals/session/management/user/) to either return 401 or 200 with a *null* payload when the user is anonymous.

* ***DiagnosticsEnvironments***

  The ASP.NET environment names that enable the diagnostics endpoint. Defaults to âDevelopmentâ.

* ***BackChannelHttpHandler*** A HTTP message handler thatâs used to configure backchannel communication. Typically used during testing. Configuring this will automatically configure the BackChannelHttpHandler property in *OpenIDConnectOptions* and also set it as the primary http message handler for retrieving the index.html.

* ***AutomaticallyRegisterBffMiddleware*** (added in 4.0) When applying BFF V4 multiple frontends, a lot of middlewares get automatically added to the pipeline. For example, the frontend selection middleware, the authentication handlers, etc. If you donât want this automatic behavior, then you can turn it off and register these middlewares manually.

* ***StaticAssetsClientName*** If BFF is configured to automatically retrieve the `index.html`, or to proxy the static assets, it needs an HTTP client to do so. With this name, you can automatically configure this HTTP client in the `HttpClientFactory`.

* ***AllowedSilentLoginReferers*** For silent login to work, you normally need to have the BFF backend and the frontend on the same origin. If you have a split host scenario, meaning the backend on a different origin (but same site) as the frontend, then you can use the referer header to differentiate which browser window to post the silent login results to. This array must then contain the list of allowed referer header values.

## Paths

[Section titled âPathsâ](#paths)

* ***LoginPath***

  Sets the path to the login endpoint. Defaults to */bff/login*.

* ***SilentLoginPath***

  Sets the path to the silent login endpoint. Defaults to */bff/silent-login*.

* ***SilentLoginCallbackPath***

  Sets the path to the silent login callback endpoint. Defaults to */bff/silent-login-callback*.

* ***LogoutPath***

  Sets the path to the logout endpoint. Defaults to */bff/logout*.

* ***UserPath***

  Sets the path to the user endpoint. Defaults to */bff/user*.

* ***BackChannelLogoutPath***

  Sets the path to the backchannel logout endpoint. Defaults to */bff/backchannel*.

* ***DiagnosticsPath***

  Sets the path to the diagnostics endpoint. Defaults to */bff/diagnostics*.

## Session Management

[Section titled âSession Managementâ](#session-management)

* ***ManagementBasePath***

  Base path for management endpoints. Defaults to */bff*.

* ***RequireLogoutSessionId***

  Flag that specifies if the *sid* claim needs to be present in the logout request as query string parameter. Used to prevent cross site request forgery. Defaults to *true*.

* ***RevokeRefreshTokenOnLogout***

  Specifies if the userâs refresh token is automatically revoked at logout time. Defaults to *true*.

* ***BackchannelLogoutAllUserSessions***

  Specifies if during backchannel logout all matching user sessions are logged out. If *true*, all sessions for the subject will be revoked. If false, just the specific session will be revoked. Defaults to *false*.

* ***~~EnableSessionCleanup~~*** (removed in V4)

  Indicates if expired server side sessions should be cleaned up. This requires an implementation of IUserSessionStoreCleanup to be registered in the ASP.NET Core service provider. Defaults to *false*.

  In V4, you need to opt into this value by calling **.AddSessionCleanupBackgroundProcess()**

* ***SessionCleanupInterval***

  Interval at which expired sessions are cleaned up. Defaults to *10 minutes*.

## APIs

[Section titled âAPIsâ](#apis)

* ***AntiForgeryHeaderName***

  Specifies the name of the header used for anti-forgery header protection. Defaults to *X-CSRF*.

* ***AntiForgeryHeaderValue***

  Specifies the expected value of Anti-forgery header. Defaults to *1*.

* ***DPoPJsonWebKey***

  Specifies the Json Web Key to use when creating DPoP proof tokens. Defaults to null, which is appropriate when not using DPoP.

* ***RemoveSessionAfterRefreshTokenExpiration*** Flag that specifies if a user session should be removed after an attempt to use a Refresh Token to acquire a new Access Token fails. This behavior is only triggered when proxying requests to remote APIs with TokenType.User or TokenType.UserOrClient. Defaults to True.

* ***DisableAntiForgeryCheck*** (added in V4) A delegate that determines if the anti-forgery check should be disabled for a given request. The default is not to disable anti-forgery checks.