diff --git a/.github/workflows/deploy-to-azure.yml b/.github/workflows/deploy-to-azure.yml
index 2815779..2124fdd 100644
--- a/.github/workflows/deploy-to-azure.yml
+++ b/.github/workflows/deploy-to-azure.yml
@@ -47,7 +47,7 @@ jobs:
- name: npm setup
working-directory: ui
- run: npm install --force --ignore-scripts
+ run: npm install --frozen-lockfile --force --ignore-scripts
- name: ui-angular-cli-build
working-directory: ui
diff --git a/.github/workflows/dotnet-and-npm-build.yml b/.github/workflows/dotnet-and-npm-build.yml
index 6a84585..aff782f 100644
--- a/.github/workflows/dotnet-and-npm-build.yml
+++ b/.github/workflows/dotnet-and-npm-build.yml
@@ -23,7 +23,7 @@ jobs:
- name: npm setup
working-directory: ui
- run: npm install --force --ignore-scripts
+ run: npm install --frozen-lockfile --force --ignore-scripts
- name: ui-angular-cli-build
working-directory: ui
diff --git a/Bff.AppHost/Bff.AppHost.csproj b/Bff.AppHost/Bff.AppHost.csproj
index 5500fc0..7d00a17 100644
--- a/Bff.AppHost/Bff.AppHost.csproj
+++ b/Bff.AppHost/Bff.AppHost.csproj
@@ -9,8 +9,8 @@
-
-
+
+
diff --git a/Bff.ServiceDefaults/Bff.ServiceDefaults.csproj b/Bff.ServiceDefaults/Bff.ServiceDefaults.csproj
index 98d36c9..9e675fc 100644
--- a/Bff.ServiceDefaults/Bff.ServiceDefaults.csproj
+++ b/Bff.ServiceDefaults/Bff.ServiceDefaults.csproj
@@ -10,10 +10,10 @@
-
-
-
-
+
+
+
+
diff --git a/README.md b/README.md
index 90b7c8e..a1ddb51 100644
--- a/README.md
+++ b/README.md
@@ -38,7 +38,7 @@ For local development environment setup proceed as follows:
1. Check out the repository
1. Install Angular CLI latest globally `npm install -g @angular/cli latest`
-1. Open `Bff.sln` in Visual Studio 2022 or later
+1. Open `Bff.sln` in Visual Studio 2026 or later
1. Set `Bff.AppHost` as startup project
1. Run the project (F5)
1. Open URL of `bffmicrosoftentraid-server` from the Aspire dashboard (usually `https://localhost:5001`)
@@ -88,6 +88,7 @@ ng update @angular/cli @angular/core
## History
+- 2026-06-24 Updated NuGet packages, added new security headers
- 2026-05-16 Updated NuGet packages, updated Angular to 21.2.0
- 2026-03-18 Updated .NET Aspire to 13.1.2, updated xunit to xunit.v3, moved permissions from workflow level to job level, updated npm packages
- 2026-03-14 Updated Nuget packages
diff --git a/server/BffMicrosoftEntraID.Server.csproj b/server/BffMicrosoftEntraID.Server.csproj
index 04e0939..d02a193 100644
--- a/server/BffMicrosoftEntraID.Server.csproj
+++ b/server/BffMicrosoftEntraID.Server.csproj
@@ -21,12 +21,12 @@
-
-
-
-
-
-
+
+
+
+
+
+
diff --git a/server/Controllers/AccountController.cs b/server/Controllers/AccountController.cs
index ab67451..e50d91f 100644
--- a/server/Controllers/AccountController.cs
+++ b/server/Controllers/AccountController.cs
@@ -31,6 +31,7 @@ public ActionResult Login(string? returnUrl, string? claimsChallenge)
[HttpPost("Logout")]
public IActionResult Logout()
{
+ Response.Headers.Append("Clear-Site-Data", "\"cache\", \"cookies\"");
return SignOut(
new AuthenticationProperties { RedirectUri = "/" },
CookieAuthenticationDefaults.AuthenticationScheme,
diff --git a/tests/BffMicrosoftEntraID.Server.IntegrationTests.csproj b/tests/BffMicrosoftEntraID.Server.IntegrationTests.csproj
index 95ca176..16b0fe0 100644
--- a/tests/BffMicrosoftEntraID.Server.IntegrationTests.csproj
+++ b/tests/BffMicrosoftEntraID.Server.IntegrationTests.csproj
@@ -8,12 +8,12 @@
-
+
all
runtime; build; native; contentfiles; analyzers; buildtransitive
-
-
+
+
all