diff --git a/apps/bff-springboot3/.gitignore b/apps/bff-springboot3/.gitignore
new file mode 100644
index 00000000..549e00a2
--- /dev/null
+++ b/apps/bff-springboot3/.gitignore
@@ -0,0 +1,33 @@
+HELP.md
+target/
+!.mvn/wrapper/maven-wrapper.jar
+!**/src/main/**/target/
+!**/src/test/**/target/
+
+### STS ###
+.apt_generated
+.classpath
+.factorypath
+.project
+.settings
+.springBeans
+.sts4-cache
+
+### IntelliJ IDEA ###
+.idea
+*.iws
+*.iml
+*.ipr
+
+### NetBeans ###
+/nbproject/private/
+/nbbuild/
+/dist/
+/nbdist/
+/.nb-gradle/
+build/
+!**/src/main/**/build/
+!**/src/test/**/build/
+
+### VS Code ###
+.vscode/
diff --git a/apps/bff-springboot3/.mvn/wrapper/maven-wrapper.properties b/apps/bff-springboot3/.mvn/wrapper/maven-wrapper.properties
new file mode 100644
index 00000000..2e76e189
--- /dev/null
+++ b/apps/bff-springboot3/.mvn/wrapper/maven-wrapper.properties
@@ -0,0 +1,2 @@
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.4/apache-maven-3.9.4-bin.zip
+wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar
diff --git a/apps/bff-springboot3/mvnw b/apps/bff-springboot3/mvnw
new file mode 100755
index 00000000..66df2854
--- /dev/null
+++ b/apps/bff-springboot3/mvnw
@@ -0,0 +1,308 @@
+#!/bin/sh
+# ----------------------------------------------------------------------------
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+# ----------------------------------------------------------------------------
+
+# ----------------------------------------------------------------------------
+# Apache Maven Wrapper startup batch script, version 3.2.0
+#
+# Required ENV vars:
+# ------------------
+#   JAVA_HOME - location of a JDK home dir
+#
+# Optional ENV vars
+# -----------------
+#   MAVEN_OPTS - parameters passed to the Java VM when running Maven
+#     e.g. to debug Maven itself, use
+#       set MAVEN_OPTS=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000
+#   MAVEN_SKIP_RC - flag to disable loading of mavenrc files
+# ----------------------------------------------------------------------------
+
+if [ -z "$MAVEN_SKIP_RC" ] ; then
+
+  if [ -f /usr/local/etc/mavenrc ] ; then
+    . /usr/local/etc/mavenrc
+  fi
+
+  if [ -f /etc/mavenrc ] ; then
+    . /etc/mavenrc
+  fi
+
+  if [ -f "$HOME/.mavenrc" ] ; then
+    . "$HOME/.mavenrc"
+  fi
+
+fi
+
+# OS specific support.  $var _must_ be set to either true or false.
+cygwin=false;
+darwin=false;
+mingw=false
+case "$(uname)" in
+  CYGWIN*) cygwin=true ;;
+  MINGW*) mingw=true;;
+  Darwin*) darwin=true
+    # Use /usr/libexec/java_home if available, otherwise fall back to /Library/Java/Home
+    # See https://developer.apple.com/library/mac/qa/qa1170/_index.html
+    if [ -z "$JAVA_HOME" ]; then
+      if [ -x "/usr/libexec/java_home" ]; then
+        JAVA_HOME="$(/usr/libexec/java_home)"; export JAVA_HOME
+      else
+        JAVA_HOME="/Library/Java/Home"; export JAVA_HOME
+      fi
+    fi
+    ;;
+esac
+
+if [ -z "$JAVA_HOME" ] ; then
+  if [ -r /etc/gentoo-release ] ; then
+    JAVA_HOME=$(java-config --jre-home)
+  fi
+fi
+
+# For Cygwin, ensure paths are in UNIX format before anything is touched
+if $cygwin ; then
+  [ -n "$JAVA_HOME" ] &&
+    JAVA_HOME=$(cygpath --unix "$JAVA_HOME")
+  [ -n "$CLASSPATH" ] &&
+    CLASSPATH=$(cygpath --path --unix "$CLASSPATH")
+fi
+
+# For Mingw, ensure paths are in UNIX format before anything is touched
+if $mingw ; then
+  [ -n "$JAVA_HOME" ] && [ -d "$JAVA_HOME" ] &&
+    JAVA_HOME="$(cd "$JAVA_HOME" || (echo "cannot cd into $JAVA_HOME."; exit 1); pwd)"
+fi
+
+if [ -z "$JAVA_HOME" ]; then
+  javaExecutable="$(which javac)"
+  if [ -n "$javaExecutable" ] && ! [ "$(expr "\"$javaExecutable\"" : '\([^ ]*\)')" = "no" ]; then
+    # readlink(1) is not available as standard on Solaris 10.
+    readLink=$(which readlink)
+    if [ ! "$(expr "$readLink" : '\([^ ]*\)')" = "no" ]; then
+      if $darwin ; then
+        javaHome="$(dirname "\"$javaExecutable\"")"
+        javaExecutable="$(cd "\"$javaHome\"" && pwd -P)/javac"
+      else
+        javaExecutable="$(readlink -f "\"$javaExecutable\"")"
+      fi
+      javaHome="$(dirname "\"$javaExecutable\"")"
+      javaHome=$(expr "$javaHome" : '\(.*\)/bin')
+      JAVA_HOME="$javaHome"
+      export JAVA_HOME
+    fi
+  fi
+fi
+
+if [ -z "$JAVACMD" ] ; then
+  if [ -n "$JAVA_HOME"  ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+      # IBM's JDK on AIX uses strange locations for the executables
+      JAVACMD="$JAVA_HOME/jre/sh/java"
+    else
+      JAVACMD="$JAVA_HOME/bin/java"
+    fi
+  else
+    JAVACMD="$(\unset -f command 2>/dev/null; \command -v java)"
+  fi
+fi
+
+if [ ! -x "$JAVACMD" ] ; then
+  echo "Error: JAVA_HOME is not defined correctly." >&2
+  echo "  We cannot execute $JAVACMD" >&2
+  exit 1
+fi
+
+if [ -z "$JAVA_HOME" ] ; then
+  echo "Warning: JAVA_HOME environment variable is not set."
+fi
+
+# traverses directory structure from process work directory to filesystem root
+# first directory with .mvn subdirectory is considered project base directory
+find_maven_basedir() {
+  if [ -z "$1" ]
+  then
+    echo "Path not specified to find_maven_basedir"
+    return 1
+  fi
+
+  basedir="$1"
+  wdir="$1"
+  while [ "$wdir" != '/' ] ; do
+    if [ -d "$wdir"/.mvn ] ; then
+      basedir=$wdir
+      break
+    fi
+    # workaround for JBEAP-8937 (on Solaris 10/Sparc)
+    if [ -d "${wdir}" ]; then
+      wdir=$(cd "$wdir/.." || exit 1; pwd)
+    fi
+    # end of workaround
+  done
+  printf '%s' "$(cd "$basedir" || exit 1; pwd)"
+}
+
+# concatenates all lines of a file
+concat_lines() {
+  if [ -f "$1" ]; then
+    # Remove \r in case we run on Windows within Git Bash
+    # and check out the repository with auto CRLF management
+    # enabled. Otherwise, we may read lines that are delimited with
+    # \r\n and produce $'-Xarg\r' rather than -Xarg due to word
+    # splitting rules.
+    tr -s '\r\n' ' ' < "$1"
+  fi
+}
+
+log() {
+  if [ "$MVNW_VERBOSE" = true ]; then
+    printf '%s\n' "$1"
+  fi
+}
+
+BASE_DIR=$(find_maven_basedir "$(dirname "$0")")
+if [ -z "$BASE_DIR" ]; then
+  exit 1;
+fi
+
+MAVEN_PROJECTBASEDIR=${MAVEN_BASEDIR:-"$BASE_DIR"}; export MAVEN_PROJECTBASEDIR
+log "$MAVEN_PROJECTBASEDIR"
+
+##########################################################################################
+# Extension to allow automatically downloading the maven-wrapper.jar from Maven-central
+# This allows using the maven wrapper in projects that prohibit checking in binary data.
+##########################################################################################
+wrapperJarPath="$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.jar"
+if [ -r "$wrapperJarPath" ]; then
+    log "Found $wrapperJarPath"
+else
+    log "Couldn't find $wrapperJarPath, downloading it ..."
+
+    if [ -n "$MVNW_REPOURL" ]; then
+      wrapperUrl="$MVNW_REPOURL/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar"
+    else
+      wrapperUrl="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar"
+    fi
+    while IFS="=" read -r key value; do
+      # Remove '\r' from value to allow usage on windows as IFS does not consider '\r' as a separator ( considers space, tab, new line ('\n'), and custom '=' )
+      safeValue=$(echo "$value" | tr -d '\r')
+      case "$key" in (wrapperUrl) wrapperUrl="$safeValue"; break ;;
+      esac
+    done < "$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.properties"
+    log "Downloading from: $wrapperUrl"
+
+    if $cygwin; then
+      wrapperJarPath=$(cygpath --path --windows "$wrapperJarPath")
+    fi
+
+    if command -v wget > /dev/null; then
+        log "Found wget ... using wget"
+        [ "$MVNW_VERBOSE" = true ] && QUIET="" || QUIET="--quiet"
+        if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then
+            wget $QUIET "$wrapperUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath"
+        else
+            wget $QUIET --http-user="$MVNW_USERNAME" --http-password="$MVNW_PASSWORD" "$wrapperUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath"
+        fi
+    elif command -v curl > /dev/null; then
+        log "Found curl ... using curl"
+        [ "$MVNW_VERBOSE" = true ] && QUIET="" || QUIET="--silent"
+        if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then
+            curl $QUIET -o "$wrapperJarPath" "$wrapperUrl" -f -L || rm -f "$wrapperJarPath"
+        else
+            curl $QUIET --user "$MVNW_USERNAME:$MVNW_PASSWORD" -o "$wrapperJarPath" "$wrapperUrl" -f -L || rm -f "$wrapperJarPath"
+        fi
+    else
+        log "Falling back to using Java to download"
+        javaSource="$MAVEN_PROJECTBASEDIR/.mvn/wrapper/MavenWrapperDownloader.java"
+        javaClass="$MAVEN_PROJECTBASEDIR/.mvn/wrapper/MavenWrapperDownloader.class"
+        # For Cygwin, switch paths to Windows format before running javac
+        if $cygwin; then
+          javaSource=$(cygpath --path --windows "$javaSource")
+          javaClass=$(cygpath --path --windows "$javaClass")
+        fi
+        if [ -e "$javaSource" ]; then
+            if [ ! -e "$javaClass" ]; then
+                log " - Compiling MavenWrapperDownloader.java ..."
+                ("$JAVA_HOME/bin/javac" "$javaSource")
+            fi
+            if [ -e "$javaClass" ]; then
+                log " - Running MavenWrapperDownloader.java ..."
+                ("$JAVA_HOME/bin/java" -cp .mvn/wrapper MavenWrapperDownloader "$wrapperUrl" "$wrapperJarPath") || rm -f "$wrapperJarPath"
+            fi
+        fi
+    fi
+fi
+##########################################################################################
+# End of extension
+##########################################################################################
+
+# If specified, validate the SHA-256 sum of the Maven wrapper jar file
+wrapperSha256Sum=""
+while IFS="=" read -r key value; do
+  case "$key" in (wrapperSha256Sum) wrapperSha256Sum=$value; break ;;
+  esac
+done < "$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.properties"
+if [ -n "$wrapperSha256Sum" ]; then
+  wrapperSha256Result=false
+  if command -v sha256sum > /dev/null; then
+    if echo "$wrapperSha256Sum  $wrapperJarPath" | sha256sum -c > /dev/null 2>&1; then
+      wrapperSha256Result=true
+    fi
+  elif command -v shasum > /dev/null; then
+    if echo "$wrapperSha256Sum  $wrapperJarPath" | shasum -a 256 -c > /dev/null 2>&1; then
+      wrapperSha256Result=true
+    fi
+  else
+    echo "Checksum validation was requested but neither 'sha256sum' or 'shasum' are available."
+    echo "Please install either command, or disable validation by removing 'wrapperSha256Sum' from your maven-wrapper.properties."
+    exit 1
+  fi
+  if [ $wrapperSha256Result = false ]; then
+    echo "Error: Failed to validate Maven wrapper SHA-256, your Maven wrapper might be compromised." >&2
+    echo "Investigate or delete $wrapperJarPath to attempt a clean download." >&2
+    echo "If you updated your Maven version, you need to update the specified wrapperSha256Sum property." >&2
+    exit 1
+  fi
+fi
+
+MAVEN_OPTS="$(concat_lines "$MAVEN_PROJECTBASEDIR/.mvn/jvm.config") $MAVEN_OPTS"
+
+# For Cygwin, switch paths to Windows format before running java
+if $cygwin; then
+  [ -n "$JAVA_HOME" ] &&
+    JAVA_HOME=$(cygpath --path --windows "$JAVA_HOME")
+  [ -n "$CLASSPATH" ] &&
+    CLASSPATH=$(cygpath --path --windows "$CLASSPATH")
+  [ -n "$MAVEN_PROJECTBASEDIR" ] &&
+    MAVEN_PROJECTBASEDIR=$(cygpath --path --windows "$MAVEN_PROJECTBASEDIR")
+fi
+
+# Provide a "standardized" way to retrieve the CLI args that will
+# work with both Windows and non-Windows executions.
+MAVEN_CMD_LINE_ARGS="$MAVEN_CONFIG $*"
+export MAVEN_CMD_LINE_ARGS
+
+WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain
+
+# shellcheck disable=SC2086 # safe args
+exec "$JAVACMD" \
+  $MAVEN_OPTS \
+  $MAVEN_DEBUG_OPTS \
+  -classpath "$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.jar" \
+  "-Dmaven.multiModuleProjectDirectory=${MAVEN_PROJECTBASEDIR}" \
+  ${WRAPPER_LAUNCHER} $MAVEN_CONFIG "$@"
diff --git a/apps/bff-springboot3/mvnw.cmd b/apps/bff-springboot3/mvnw.cmd
new file mode 100644
index 00000000..95ba6f54
--- /dev/null
+++ b/apps/bff-springboot3/mvnw.cmd
@@ -0,0 +1,205 @@
+@REM ----------------------------------------------------------------------------
+@REM Licensed to the Apache Software Foundation (ASF) under one
+@REM or more contributor license agreements.  See the NOTICE file
+@REM distributed with this work for additional information
+@REM regarding copyright ownership.  The ASF licenses this file
+@REM to you under the Apache License, Version 2.0 (the
+@REM "License"); you may not use this file except in compliance
+@REM with the License.  You may obtain a copy of the License at
+@REM
+@REM    https://www.apache.org/licenses/LICENSE-2.0
+@REM
+@REM Unless required by applicable law or agreed to in writing,
+@REM software distributed under the License is distributed on an
+@REM "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+@REM KIND, either express or implied.  See the License for the
+@REM specific language governing permissions and limitations
+@REM under the License.
+@REM ----------------------------------------------------------------------------
+
+@REM ----------------------------------------------------------------------------
+@REM Apache Maven Wrapper startup batch script, version 3.2.0
+@REM
+@REM Required ENV vars:
+@REM JAVA_HOME - location of a JDK home dir
+@REM
+@REM Optional ENV vars
+@REM MAVEN_BATCH_ECHO - set to 'on' to enable the echoing of the batch commands
+@REM MAVEN_BATCH_PAUSE - set to 'on' to wait for a keystroke before ending
+@REM MAVEN_OPTS - parameters passed to the Java VM when running Maven
+@REM     e.g. to debug Maven itself, use
+@REM set MAVEN_OPTS=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000
+@REM MAVEN_SKIP_RC - flag to disable loading of mavenrc files
+@REM ----------------------------------------------------------------------------
+
+@REM Begin all REM lines with '@' in case MAVEN_BATCH_ECHO is 'on'
+@echo off
+@REM set title of command window
+title %0
+@REM enable echoing by setting MAVEN_BATCH_ECHO to 'on'
+@if "%MAVEN_BATCH_ECHO%" == "on"  echo %MAVEN_BATCH_ECHO%
+
+@REM set %HOME% to equivalent of $HOME
+if "%HOME%" == "" (set "HOME=%HOMEDRIVE%%HOMEPATH%")
+
+@REM Execute a user defined script before this one
+if not "%MAVEN_SKIP_RC%" == "" goto skipRcPre
+@REM check for pre script, once with legacy .bat ending and once with .cmd ending
+if exist "%USERPROFILE%\mavenrc_pre.bat" call "%USERPROFILE%\mavenrc_pre.bat" %*
+if exist "%USERPROFILE%\mavenrc_pre.cmd" call "%USERPROFILE%\mavenrc_pre.cmd" %*
+:skipRcPre
+
+@setlocal
+
+set ERROR_CODE=0
+
+@REM To isolate internal variables from possible post scripts, we use another setlocal
+@setlocal
+
+@REM ==== START VALIDATION ====
+if not "%JAVA_HOME%" == "" goto OkJHome
+
+echo.
+echo Error: JAVA_HOME not found in your environment. >&2
+echo Please set the JAVA_HOME variable in your environment to match the >&2
+echo location of your Java installation. >&2
+echo.
+goto error
+
+:OkJHome
+if exist "%JAVA_HOME%\bin\java.exe" goto init
+
+echo.
+echo Error: JAVA_HOME is set to an invalid directory. >&2
+echo JAVA_HOME = "%JAVA_HOME%" >&2
+echo Please set the JAVA_HOME variable in your environment to match the >&2
+echo location of your Java installation. >&2
+echo.
+goto error
+
+@REM ==== END VALIDATION ====
+
+:init
+
+@REM Find the project base dir, i.e. the directory that contains the folder ".mvn".
+@REM Fallback to current working directory if not found.
+
+set MAVEN_PROJECTBASEDIR=%MAVEN_BASEDIR%
+IF NOT "%MAVEN_PROJECTBASEDIR%"=="" goto endDetectBaseDir
+
+set EXEC_DIR=%CD%
+set WDIR=%EXEC_DIR%
+:findBaseDir
+IF EXIST "%WDIR%"\.mvn goto baseDirFound
+cd ..
+IF "%WDIR%"=="%CD%" goto baseDirNotFound
+set WDIR=%CD%
+goto findBaseDir
+
+:baseDirFound
+set MAVEN_PROJECTBASEDIR=%WDIR%
+cd "%EXEC_DIR%"
+goto endDetectBaseDir
+
+:baseDirNotFound
+set MAVEN_PROJECTBASEDIR=%EXEC_DIR%
+cd "%EXEC_DIR%"
+
+:endDetectBaseDir
+
+IF NOT EXIST "%MAVEN_PROJECTBASEDIR%\.mvn\jvm.config" goto endReadAdditionalConfig
+
+@setlocal EnableExtensions EnableDelayedExpansion
+for /F "usebackq delims=" %%a in ("%MAVEN_PROJECTBASEDIR%\.mvn\jvm.config") do set JVM_CONFIG_MAVEN_PROPS=!JVM_CONFIG_MAVEN_PROPS! %%a
+@endlocal & set JVM_CONFIG_MAVEN_PROPS=%JVM_CONFIG_MAVEN_PROPS%
+
+:endReadAdditionalConfig
+
+SET MAVEN_JAVA_EXE="%JAVA_HOME%\bin\java.exe"
+set WRAPPER_JAR="%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.jar"
+set WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain
+
+set WRAPPER_URL="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar"
+
+FOR /F "usebackq tokens=1,2 delims==" %%A IN ("%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.properties") DO (
+    IF "%%A"=="wrapperUrl" SET WRAPPER_URL=%%B
+)
+
+@REM Extension to allow automatically downloading the maven-wrapper.jar from Maven-central
+@REM This allows using the maven wrapper in projects that prohibit checking in binary data.
+if exist %WRAPPER_JAR% (
+    if "%MVNW_VERBOSE%" == "true" (
+        echo Found %WRAPPER_JAR%
+    )
+) else (
+    if not "%MVNW_REPOURL%" == "" (
+        SET WRAPPER_URL="%MVNW_REPOURL%/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar"
+    )
+    if "%MVNW_VERBOSE%" == "true" (
+        echo Couldn't find %WRAPPER_JAR%, downloading it ...
+        echo Downloading from: %WRAPPER_URL%
+    )
+
+    powershell -Command "&{"^
+		"$webclient = new-object System.Net.WebClient;"^
+		"if (-not ([string]::IsNullOrEmpty('%MVNW_USERNAME%') -and [string]::IsNullOrEmpty('%MVNW_PASSWORD%'))) {"^
+		"$webclient.Credentials = new-object System.Net.NetworkCredential('%MVNW_USERNAME%', '%MVNW_PASSWORD%');"^
+		"}"^
+		"[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $webclient.DownloadFile('%WRAPPER_URL%', '%WRAPPER_JAR%')"^
+		"}"
+    if "%MVNW_VERBOSE%" == "true" (
+        echo Finished downloading %WRAPPER_JAR%
+    )
+)
+@REM End of extension
+
+@REM If specified, validate the SHA-256 sum of the Maven wrapper jar file
+SET WRAPPER_SHA_256_SUM=""
+FOR /F "usebackq tokens=1,2 delims==" %%A IN ("%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.properties") DO (
+    IF "%%A"=="wrapperSha256Sum" SET WRAPPER_SHA_256_SUM=%%B
+)
+IF NOT %WRAPPER_SHA_256_SUM%=="" (
+    powershell -Command "&{"^
+       "$hash = (Get-FileHash \"%WRAPPER_JAR%\" -Algorithm SHA256).Hash.ToLower();"^
+       "If('%WRAPPER_SHA_256_SUM%' -ne $hash){"^
+       "  Write-Output 'Error: Failed to validate Maven wrapper SHA-256, your Maven wrapper might be compromised.';"^
+       "  Write-Output 'Investigate or delete %WRAPPER_JAR% to attempt a clean download.';"^
+       "  Write-Output 'If you updated your Maven version, you need to update the specified wrapperSha256Sum property.';"^
+       "  exit 1;"^
+       "}"^
+       "}"
+    if ERRORLEVEL 1 goto error
+)
+
+@REM Provide a "standardized" way to retrieve the CLI args that will
+@REM work with both Windows and non-Windows executions.
+set MAVEN_CMD_LINE_ARGS=%*
+
+%MAVEN_JAVA_EXE% ^
+  %JVM_CONFIG_MAVEN_PROPS% ^
+  %MAVEN_OPTS% ^
+  %MAVEN_DEBUG_OPTS% ^
+  -classpath %WRAPPER_JAR% ^
+  "-Dmaven.multiModuleProjectDirectory=%MAVEN_PROJECTBASEDIR%" ^
+  %WRAPPER_LAUNCHER% %MAVEN_CONFIG% %*
+if ERRORLEVEL 1 goto error
+goto end
+
+:error
+set ERROR_CODE=1
+
+:end
+@endlocal & set ERROR_CODE=%ERROR_CODE%
+
+if not "%MAVEN_SKIP_RC%"=="" goto skipRcPost
+@REM check for post script, once with legacy .bat ending and once with .cmd ending
+if exist "%USERPROFILE%\mavenrc_post.bat" call "%USERPROFILE%\mavenrc_post.bat"
+if exist "%USERPROFILE%\mavenrc_post.cmd" call "%USERPROFILE%\mavenrc_post.cmd"
+:skipRcPost
+
+@REM pause the script if MAVEN_BATCH_PAUSE is set to 'on'
+if "%MAVEN_BATCH_PAUSE%"=="on" pause
+
+if "%MAVEN_TERMINATE_CMD%"=="on" exit %ERROR_CODE%
+
+cmd /C exit /B %ERROR_CODE%
diff --git a/apps/bff-springboot3/pom.xml b/apps/bff-springboot3/pom.xml
new file mode 100644
index 00000000..4b817d9e
--- /dev/null
+++ b/apps/bff-springboot3/pom.xml
@@ -0,0 +1,95 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-parent</artifactId>
+        <version>3.1.4</version>
+        <relativePath/> <!-- lookup parent from repository -->
+    </parent>
+    <groupId>com.github.thomasdarimont.training</groupId>
+    <artifactId>bff-springboot3</artifactId>
+    <version>0.0.1-SNAPSHOT</version>
+    <name>bff-springboot3</name>
+    <description>bff-springboot3</description>
+    <properties>
+        <java.version>17</java.version>
+    </properties>
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-oauth2-client</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.thymeleaf.extras</groupId>
+            <artifactId>thymeleaf-extras-springsecurity6</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-thymeleaf</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-data-redis</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.session</groupId>
+            <artifactId>spring-session-data-redis</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>io.lettuce</groupId>
+            <artifactId>lettuce-core</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-devtools</artifactId>
+            <scope>runtime</scope>
+            <optional>true</optional>
+        </dependency>
+        <dependency>
+            <groupId>org.projectlombok</groupId>
+            <artifactId>lombok</artifactId>
+            <optional>true</optional>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-maven-plugin</artifactId>
+                <configuration>
+                    <excludes>
+                        <exclude>
+                            <groupId>org.projectlombok</groupId>
+                            <artifactId>lombok</artifactId>
+                        </exclude>
+                    </excludes>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>
diff --git a/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/Bff3App.java b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/Bff3App.java
new file mode 100644
index 00000000..fabc1971
--- /dev/null
+++ b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/Bff3App.java
@@ -0,0 +1,13 @@
+package com.github.thomasdarimont.apps.bff3;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class Bff3App {
+
+    public static void main(String[] args) {
+        SpringApplication.run(Bff3App.class, args);
+    }
+
+}
diff --git a/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/api/UsersResource.java b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/api/UsersResource.java
new file mode 100644
index 00000000..1ab76ba4
--- /dev/null
+++ b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/api/UsersResource.java
@@ -0,0 +1,53 @@
+package com.github.thomasdarimont.apps.bff3.api;
+
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.oauth2.core.oidc.OidcUserInfo;
+import org.springframework.security.oauth2.core.oidc.user.DefaultOidcUser;
+import org.springframework.security.oauth2.core.oidc.user.OidcUserAuthority;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.client.RestTemplate;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+@RestController
+@RequestMapping("/api/users")
+class UsersResource {
+
+    private final RestTemplate oauthRestTemplate;
+
+    public UsersResource(@Qualifier("oauth") RestTemplate oauthRestTemplate) {
+        this.oauthRestTemplate = oauthRestTemplate;
+    }
+
+    @GetMapping("/me")
+    public ResponseEntity<Object> userInfo(Authentication auth) {
+        var userInfo = getUserInfoFromAuthority(auth);
+//        var userInfo2 = getUserInfoFromRemote(auth);
+        return ResponseEntity.ok(userInfo);
+    }
+
+    private Map<String, Object> getUserInfoFromAuthority(Authentication auth) {
+        return auth.getAuthorities().stream() //
+                .filter(OidcUserAuthority.class::isInstance) //
+                .map(authority -> (OidcUserAuthority) authority)//
+                .map(OidcUserAuthority::getUserInfo) //
+                .map(OidcUserInfo::getClaims) //
+                .findFirst() //
+                .orElseGet(() -> Map.of("error", "UserInfoMissing"));
+    }
+
+    private UserInfo getUserInfoFromRemote(Authentication auth) {
+        var principal = (DefaultOidcUser) auth.getPrincipal();
+        var idToken = principal.getIdToken();
+        var issuerUri = idToken.getIssuer().toString();
+        return oauthRestTemplate.getForObject(issuerUri + "/protocol/openid-connect/userinfo", UserInfo.class);
+    }
+
+    static class UserInfo extends LinkedHashMap<String, Object> {
+    }
+}
diff --git a/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/config/OAuth2RestTemplateConfig.java b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/config/OAuth2RestTemplateConfig.java
new file mode 100644
index 00000000..22f25542
--- /dev/null
+++ b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/config/OAuth2RestTemplateConfig.java
@@ -0,0 +1,40 @@
+package com.github.thomasdarimont.apps.bff3.config;
+
+import com.github.thomasdarimont.apps.bff3.oauth.TokenAccessor;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpHeaders;
+import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
+import org.springframework.web.client.RestTemplate;
+
+@Configuration
+class OAuth2RestTemplateConfig {
+
+    /**
+     * Provides a {@link RestTemplate} that can obtain access tokes for the current user.
+     *
+     * @param tokenAccessor
+     * @return
+     */
+    @Bean
+    @Qualifier("oauth")
+    public RestTemplate oauthRestTemplate(TokenAccessor tokenAccessor) {
+
+        var restTemplate = new RestTemplate();
+        restTemplate.getInterceptors().add((request, body, execution) -> {
+
+            var accessToken = tokenAccessor.getAccessTokenForCurrentUser();
+            if (accessToken == null) {
+                throw new OAuth2AuthenticationException("missing access token");
+            }
+
+            var accessTokenValue = accessToken.getTokenValue();
+            request.getHeaders().add(HttpHeaders.AUTHORIZATION, "Bearer " + accessTokenValue);
+
+            return execution.execute(request, body);
+        });
+
+        return restTemplate;
+    }
+}
diff --git a/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/config/SessionConfig.java b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/config/SessionConfig.java
new file mode 100644
index 00000000..9f5e4897
--- /dev/null
+++ b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/config/SessionConfig.java
@@ -0,0 +1,17 @@
+package com.github.thomasdarimont.apps.bff3.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.data.redis.connection.lettuce.LettuceConnectionFactory;
+import org.springframework.session.data.redis.config.annotation.web.http.EnableRedisHttpSession;
+import org.springframework.session.web.context.AbstractHttpSessionApplicationInitializer;
+
+@Configuration
+@EnableRedisHttpSession
+class SessionConfig extends AbstractHttpSessionApplicationInitializer {
+
+    @Bean
+    public LettuceConnectionFactory connectionFactory() {
+        return new LettuceConnectionFactory();
+    }
+}
\ No newline at end of file
diff --git a/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/config/WebSecurityConfig.java b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/config/WebSecurityConfig.java
new file mode 100644
index 00000000..0cffe119
--- /dev/null
+++ b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/config/WebSecurityConfig.java
@@ -0,0 +1,98 @@
+package com.github.thomasdarimont.apps.bff3.config;
+
+import com.github.thomasdarimont.apps.bff3.config.keycloak.KeycloakLogoutHandler;
+import lombok.RequiredArgsConstructor;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
+import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
+import org.springframework.security.oauth2.client.web.AuthorizationRequestRepository;
+import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizationRequestResolver;
+import org.springframework.security.oauth2.client.web.HttpSessionOAuth2AuthorizationRequestRepository;
+import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestCustomizers;
+import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRedirectFilter;
+import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
+import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest;
+import org.springframework.security.oauth2.core.oidc.user.OidcUserAuthority;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
+
+import java.util.HashSet;
+
+@Configuration
+@RequiredArgsConstructor
+class WebSecurityConfig {
+
+    private final KeycloakLogoutHandler keycloakLogoutHandler;
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http, //
+                                           ClientRegistrationRepository clientRegistrationRepository, //
+                                           AuthorizationRequestRepository<OAuth2AuthorizationRequest> authorizationRequestRepository //
+    ) throws Exception {
+
+        http.csrf(customizer -> {
+            customizer.ignoringRequestMatchers("/spa/**").csrfTokenRepository(new CookieCsrfTokenRepository());
+        });
+//        http.sessionManagement(sess -> {
+//            sess.sessionAuthenticationStrategy()
+//        })
+
+        http.authorizeHttpRequests(arc -> {
+            // declarative route configuration
+            // add additional routes
+            arc.requestMatchers("/app/**", "/webjars/**", "/resources/**", "/css/**").permitAll();
+            arc.anyRequest().fullyAuthenticated();
+        });
+        // by default spring security oauth2 client does not support PKCE for confidential clients for auth code grant flow,
+        // we explicitly enable the PKCE customization here.
+        http.oauth2Client(o2cc -> {
+            var oauth2AuthRequestResolver = new DefaultOAuth2AuthorizationRequestResolver( //
+                    clientRegistrationRepository, //
+                    OAuth2AuthorizationRequestRedirectFilter.DEFAULT_AUTHORIZATION_REQUEST_BASE_URI //
+            );
+            oauth2AuthRequestResolver.setAuthorizationRequestCustomizer(OAuth2AuthorizationRequestCustomizers.withPkce());
+            o2cc.authorizationCodeGrant(acgc -> {
+                acgc.authorizationRequestResolver(oauth2AuthRequestResolver) //
+                        .authorizationRequestRepository(authorizationRequestRepository);
+            });
+
+        });
+        http.oauth2Login(o2lc -> {
+            //o2lc.userInfoEndpoint().userAuthoritiesMapper(userAuthoritiesMapper());
+        });
+
+        http.logout(lc -> {
+            lc.addLogoutHandler(keycloakLogoutHandler);
+        });
+
+        return http.build();
+    }
+
+    @Bean
+    public AuthorizationRequestRepository<OAuth2AuthorizationRequest> authorizationRequestRepository() {
+        return new HttpSessionOAuth2AuthorizationRequestRepository();
+    }
+
+    private GrantedAuthoritiesMapper userAuthoritiesMapper() {
+        return (authorities) -> {
+            var mappedAuthorities = new HashSet<GrantedAuthority>();
+
+            authorities.forEach(authority -> {
+                if (authority instanceof OidcUserAuthority) {
+                    var oidcUserAuthority = (OidcUserAuthority) authority;
+
+                    var userInfo = oidcUserAuthority.getUserInfo();
+
+                    // TODO extract roles from userInfo response
+//                    List<SimpleGrantedAuthority> groupAuthorities = userInfo.getClaimAsStringList("groups").stream().map(g -> new SimpleGrantedAuthority("ROLE_" + g.toUpperCase())).collect(Collectors.toList());
+//                    mappedAuthorities.addAll(groupAuthorities);
+                }
+            });
+
+            return mappedAuthorities;
+        };
+    }
+}
\ No newline at end of file
diff --git a/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/config/keycloak/KeycloakLogoutHandler.java b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/config/keycloak/KeycloakLogoutHandler.java
new file mode 100644
index 00000000..43927677
--- /dev/null
+++ b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/config/keycloak/KeycloakLogoutHandler.java
@@ -0,0 +1,54 @@
+package com.github.thomasdarimont.apps.bff3.config.keycloak;
+
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.oauth2.core.oidc.user.DefaultOidcUser;
+import org.springframework.security.web.authentication.logout.LogoutHandler;
+import org.springframework.stereotype.Component;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+import java.io.IOException;
+
+@Slf4j
+@Component
+public class KeycloakLogoutHandler implements LogoutHandler {
+
+    @Override
+    public void logout(HttpServletRequest request, HttpServletResponse response, Authentication auth) {
+
+        var principal = (DefaultOidcUser) auth.getPrincipal();
+        var idToken = principal.getIdToken();
+
+        log.info("Propagate logout to keycloak for user. userId={}", idToken.getSubject());
+
+        var issuerUri = idToken.getIssuer().toString();
+        var idTokenValue = idToken.getTokenValue();
+
+        var defaultRedirectUri = generateAppUri(request);
+
+        var logoutUrl = createKeycloakLogoutUrl(issuerUri, idTokenValue, defaultRedirectUri);
+
+        try {
+            response.sendRedirect(logoutUrl);
+        } catch (IOException e) {
+            e.printStackTrace();
+        }
+
+    }
+
+    private String generateAppUri(HttpServletRequest request) {
+        var hostname = request.getServerName() + ":" + request.getServerPort();
+        var isStandardHttps = "https".equals(request.getScheme()) && request.getServerPort() == 443;
+        var isStandardHttp = "http".equals(request.getScheme()) && request.getServerPort() == 80;
+        if (isStandardHttps || isStandardHttp) {
+            hostname = request.getServerName();
+        }
+        return request.getScheme() + "://" + hostname + request.getContextPath();
+    }
+
+    private String createKeycloakLogoutUrl(String issuerUri, String idTokenValue, String defaultRedirectUri) {
+        return issuerUri + "/protocol/openid-connect/logout?id_token_hint=" + idTokenValue + "&post_logout_redirect_uri=" + defaultRedirectUri;
+    }
+}
diff --git a/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/oauth/TokenAccessor.java b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/oauth/TokenAccessor.java
new file mode 100644
index 00000000..fa9e2132
--- /dev/null
+++ b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/oauth/TokenAccessor.java
@@ -0,0 +1,89 @@
+package com.github.thomasdarimont.apps.bff3.oauth;
+
+import lombok.Getter;
+import lombok.RequiredArgsConstructor;
+import lombok.Setter;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
+import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
+import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
+import org.springframework.security.oauth2.core.OAuth2AccessToken;
+import org.springframework.security.oauth2.core.OAuth2RefreshToken;
+import org.springframework.stereotype.Component;
+
+import java.time.Duration;
+import java.time.Instant;
+
+/**
+ * Provides access to OAuth2 access- and refresh-tokens of an authenticated user.
+ */
+@Slf4j
+@Getter
+@Setter
+@Component
+@RequiredArgsConstructor
+public class TokenAccessor {
+
+    private final OAuth2AuthorizedClientService authorizedClientService;
+
+    private final TokenRefresher tokenRefresher;
+
+    private Duration accessTokenExpiresSkew = Duration.ofSeconds(10);
+
+    private boolean tokenRefreshEnabled = true;
+
+    public OAuth2AccessToken getAccessTokenForCurrentUser() {
+        return getAccessToken(SecurityContextHolder.getContext().getAuthentication());
+    }
+
+    public OAuth2AccessToken getAccessToken(Authentication auth) {
+
+        var client = getOAuth2AuthorizedClient(auth);
+        if (client == null) {
+            return null;
+        }
+
+        var accessToken = client.getAccessToken();
+        if (accessToken == null) {
+            return null;
+        }
+
+        var accessTokenStillValid = isAccessTokenStillValid(accessToken);
+        if (!accessTokenStillValid && tokenRefreshEnabled) {
+            accessToken = tokenRefresher.refreshTokens(client);
+        }
+
+        return accessToken;
+    }
+
+    public OAuth2RefreshToken getRefreshToken(Authentication auth) {
+
+        OAuth2AuthorizedClient client = getOAuth2AuthorizedClient(auth);
+        if (client == null) {
+            return null;
+        }
+        return client.getRefreshToken();
+    }
+
+    private boolean isAccessTokenStillValid(OAuth2AccessToken accessToken) {
+        var expiresAt = accessToken.getExpiresAt();
+        if (expiresAt == null) {
+            return false;
+        }
+        var exp = expiresAt.minus(accessTokenExpiresSkew == null ? Duration.ofSeconds(0) : accessTokenExpiresSkew);
+        var now = Instant.now();
+
+        return now.isBefore(exp);
+    }
+
+
+    private OAuth2AuthorizedClient getOAuth2AuthorizedClient(Authentication auth) {
+
+        var authToken = (OAuth2AuthenticationToken) auth;
+        var clientId = authToken.getAuthorizedClientRegistrationId();
+        var username = auth.getName();
+        return authorizedClientService.loadAuthorizedClient(clientId, username);
+    }
+}
diff --git a/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/oauth/TokenIntrospector.java b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/oauth/TokenIntrospector.java
new file mode 100644
index 00000000..08d277d9
--- /dev/null
+++ b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/oauth/TokenIntrospector.java
@@ -0,0 +1,80 @@
+package com.github.thomasdarimont.apps.bff3.oauth;
+
+import com.fasterxml.jackson.annotation.JsonAnySetter;
+import jakarta.servlet.http.HttpServletRequest;
+import lombok.Data;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.HttpEntity;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
+import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
+import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
+import org.springframework.stereotype.Component;
+import org.springframework.util.LinkedMultiValueMap;
+import org.springframework.web.client.RestTemplate;
+
+import java.util.HashMap;
+import java.util.Map;
+
+@Component
+@RequiredArgsConstructor
+public class TokenIntrospector {
+
+    private final OAuth2AuthorizedClientRepository oAuth2AuthorizedClientRepository;
+
+    private final TokenAccessor tokenAccessor;
+
+    public IntrospectionResult introspectToken(Authentication auth, HttpServletRequest request) {
+
+        if (!(auth instanceof OAuth2AuthenticationToken)) {
+            return null;
+        }
+
+        var authToken = (OAuth2AuthenticationToken) auth;
+        var authorizedClient = oAuth2AuthorizedClientRepository.loadAuthorizedClient(
+                authToken.getAuthorizedClientRegistrationId(), //
+                auth, //
+                request
+        );
+
+        if (authorizedClient == null) {
+            return null;
+        }
+
+        var rt = new RestTemplate();
+        var headers = new HttpHeaders();
+        headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
+
+        var requestBody = new LinkedMultiValueMap<String, String>();
+        requestBody.add("client_id", authorizedClient.getClientRegistration().getClientId());
+        requestBody.add("client_secret", authorizedClient.getClientRegistration().getClientSecret());
+        var accessToken = tokenAccessor.getAccessToken(auth);
+        requestBody.add("token", accessToken.getTokenValue());
+        requestBody.add("token_type_hint", "access_token");
+
+        var tokenIntrospection = authorizedClient.getClientRegistration().getProviderDetails().getIssuerUri() + "/protocol/openid-connect/token/introspect";
+        var responseEntity = rt.postForEntity(tokenIntrospection, new HttpEntity<>(requestBody, headers), IntrospectionResult.class);
+
+        var responseData = responseEntity.getBody();
+        if (responseData == null || !responseData.isActive()) {
+            return null;
+        }
+
+        return responseData;
+    }
+
+    @Data
+    public static class IntrospectionResult {
+
+        private boolean active;
+
+        private Map<String, Object> data = new HashMap<>();
+
+        @JsonAnySetter
+        public void setDataEntry(String key, Object value) {
+            data.put(key, value);
+        }
+    }
+}
diff --git a/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/oauth/TokenRefresher.java b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/oauth/TokenRefresher.java
new file mode 100644
index 00000000..9b9300bb
--- /dev/null
+++ b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/oauth/TokenRefresher.java
@@ -0,0 +1,110 @@
+package com.github.thomasdarimont.apps.bff3.oauth;
+
+import com.fasterxml.jackson.annotation.JsonAnySetter;
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.JWTParser;
+import lombok.Data;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.HttpEntity;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
+import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
+import org.springframework.security.oauth2.core.OAuth2AccessToken;
+import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
+import org.springframework.security.oauth2.core.OAuth2RefreshToken;
+import org.springframework.stereotype.Component;
+import org.springframework.util.LinkedMultiValueMap;
+import org.springframework.web.client.RestTemplate;
+
+import java.text.ParseException;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * Uses the current Oauth2 refresh token of the current user session to obtain new tokens.
+ */
+@Slf4j
+@Component
+@RequiredArgsConstructor
+public class TokenRefresher {
+
+    private final OAuth2AuthorizedClientService authorizedClientService;
+
+    public OAuth2AccessToken refreshTokens(OAuth2AuthorizedClient client) {
+
+        var clientRegistration = client.getClientRegistration();
+        var refreshToken = client.getRefreshToken();
+
+        var headers = new HttpHeaders();
+        headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
+
+        var requestBody = new LinkedMultiValueMap<String, String>();
+        requestBody.add("client_id", clientRegistration.getClientId());
+        requestBody.add("client_secret", clientRegistration.getClientSecret());
+        requestBody.add("grant_type", "refresh_token");
+        requestBody.add("refresh_token", refreshToken.getTokenValue());
+
+        var rt = new RestTemplate();
+        var responseEntity = rt.postForEntity(clientRegistration.getProviderDetails().getTokenUri(), new HttpEntity<>(requestBody, headers), AccessTokenResponse.class);
+        if (!responseEntity.getStatusCode().is2xxSuccessful()) {
+            throw new OAuth2AuthenticationException("token refresh failed");
+        }
+
+        var accessTokenResponse = responseEntity.getBody();
+        var newAccessTokenValue = accessTokenResponse.access_token;
+        var newRefreshTokenValue = accessTokenResponse.refresh_token;
+
+        JWTClaimsSet newAccessTokenClaimsSet;
+        JWTClaimsSet newRefreshTokenClaimSet;
+        try {
+            var newAccessToken = JWTParser.parse(newAccessTokenValue);
+            newAccessTokenClaimsSet = newAccessToken.getJWTClaimsSet();
+        } catch (ParseException e) {
+            throw new OAuth2AuthenticationException("token refresh failed: could not parse access token");
+        }
+
+        try {
+            var newRefreshToken = JWTParser.parse(newRefreshTokenValue);
+            newRefreshTokenClaimSet = newRefreshToken.getJWTClaimsSet();
+        } catch (ParseException e) {
+            throw new OAuth2AuthenticationException("token refresh failed: could not parse refresh token");
+        }
+
+        var accessTokenIat = newAccessTokenClaimsSet.getIssueTime().toInstant();
+        var accessTokenExp = newAccessTokenClaimsSet.getExpirationTime().toInstant();
+        var newOAuth2AccessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER, newAccessTokenValue, accessTokenIat, accessTokenExp);
+
+        var refreshTokenIat = newRefreshTokenClaimSet.getIssueTime().toInstant();
+        var refreshTokenExp = newRefreshTokenClaimSet.getExpirationTime().toInstant();
+        var newOAuth2RefreshToken = new OAuth2RefreshToken(newRefreshTokenValue, refreshTokenIat, refreshTokenExp);
+
+        var newClient = new OAuth2AuthorizedClient(clientRegistration, client.getPrincipalName(), newOAuth2AccessToken, newOAuth2RefreshToken);
+        authorizedClientService.saveAuthorizedClient(newClient, SecurityContextHolder.getContext().getAuthentication());
+
+        return newOAuth2AccessToken;
+    }
+
+    @Data
+    static class AccessTokenResponse {
+
+        final long createdAtSeconds = System.currentTimeMillis() / 1000;
+
+        String access_token;
+
+        String refresh_token;
+
+        String error;
+
+        int expires_in;
+
+        Map<String, Object> metadata = new HashMap<>();
+
+        @JsonAnySetter
+        public void setMetadata(String key, Object value) {
+            metadata.put(key, value);
+        }
+    }
+}
diff --git a/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/web/AuthResource.java b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/web/AuthResource.java
new file mode 100644
index 00000000..19ed2b07
--- /dev/null
+++ b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/web/AuthResource.java
@@ -0,0 +1,53 @@
+package com.github.thomasdarimont.apps.bff3.web;
+
+import com.fasterxml.jackson.annotation.JsonAnySetter;
+import com.github.thomasdarimont.apps.bff3.oauth.TokenIntrospector;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import lombok.Data;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.core.Authentication;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.HashMap;
+import java.util.Map;
+
+@RestController
+@RequestMapping("/auth")
+@RequiredArgsConstructor
+class AuthResource {
+
+
+    private final TokenIntrospector tokenIntrospector;
+
+    @GetMapping("/check-session")
+    public ResponseEntity<?> checkSession(Authentication auth, HttpServletRequest request) throws ServletException {
+
+        var introspectionResult = tokenIntrospector.introspectToken(auth, request);
+
+        if (introspectionResult == null || !introspectionResult.isActive()) {
+//            SecurityContextHolder.clearContext();
+            request.logout();
+            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
+        }
+
+        return ResponseEntity.ok().build();
+    }
+
+    @Data
+    static class IntrospectionResponse {
+
+        private boolean active;
+
+        private Map<String, Object> data = new HashMap<>();
+
+        @JsonAnySetter
+        public void setDataEntry(String key, Object value) {
+            data.put(key, value);
+        }
+    }
+}
diff --git a/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/web/UiResource.java b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/web/UiResource.java
new file mode 100644
index 00000000..fc563b90
--- /dev/null
+++ b/apps/bff-springboot3/src/main/java/com/github/thomasdarimont/apps/bff3/web/UiResource.java
@@ -0,0 +1,17 @@
+package com.github.thomasdarimont.apps.bff3.web;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.GetMapping;
+
+@Controller
+@RequiredArgsConstructor
+class UiResource {
+
+    @GetMapping("/")
+    public String index(Model model) {
+        model.addAttribute("appScript", "/app/app.js");
+        return "/app/index";
+    }
+}
diff --git a/apps/bff-springboot3/src/main/resources/application.yml b/apps/bff-springboot3/src/main/resources/application.yml
new file mode 100644
index 00000000..c296f996
--- /dev/null
+++ b/apps/bff-springboot3/src/main/resources/application.yml
@@ -0,0 +1,40 @@
+server:
+  port: 4693
+  ssl:
+    enabled: true
+    key-store: config/stage/dev/tls/acme.test+1.p12
+    key-store-password: changeit
+    key-store-type: PKCS12
+  servlet:
+    context-path: /bff
+  error:
+    include-stacktrace: never
+
+logging:
+  level:
+    root: info
+    org:
+      springframework:
+        web: info
+
+spring:
+  thymeleaf:
+    cache: false
+  security:
+    oauth2:
+      client:
+        provider:
+          keycloak:
+            issuerUri: https://id.acme.test:8443/auth/realms/acme-internal
+            user-name-attribute: preferred_username
+        registration:
+          keycloak:
+            client-id: 'acme-bff-springboot'
+            client-secret: 'secret'
+            client-authentication-method: client_secret_post
+            authorizationGrantType: authorization_code
+            redirect-uri: '{baseUrl}/login/oauth2/code/{registrationId}'
+            scope: openid
+  data:
+    redis:
+      client-name: "acme-bff"
diff --git a/apps/bff-springboot3/src/main/resources/static/app/app.js b/apps/bff-springboot3/src/main/resources/static/app/app.js
new file mode 100644
index 00000000..3c372a65
--- /dev/null
+++ b/apps/bff-springboot3/src/main/resources/static/app/app.js
@@ -0,0 +1,47 @@
+let spa = {};
+
+function qs(selector) {
+    return document.querySelector(selector);
+}
+
+function qsa(selector) {
+    return [...document.querySelectorAll(selector)];
+}
+
+function callApi(url, requestOptions, onError) {
+    let csrfToken = qs("meta[name=_csrf]").content;
+    let csrfTokenHeader = qs("meta[name=_csrf_header]").content;
+    let requestData = {
+        timeout: 2000,
+        method: "GET",
+        credentials: "include",
+        headers: {
+            "Accept": "application/json",
+            'Content-Type': 'application/json',
+            [`${csrfTokenHeader}`]: csrfToken
+        }
+        , ...requestOptions
+    }
+    return fetch(url, requestData).catch(onError);
+}
+
+
+(async function onInit() {
+    try {
+        let userInfoResponse = await callApi("/bff/api/users/me", {});
+        if (userInfoResponse.ok) {
+            let userInfo = await userInfoResponse.json();
+            console.log(userInfo);
+            spa.userInfo = userInfo;
+        }
+    } catch {
+        console.log("failed to fetch userinfo");
+    }
+
+    if (spa.userInfo) {
+        qs("#userInfo").innerText = JSON.stringify(spa.userInfo, null, "  ");
+        qs("#login").remove()
+    } else {
+        qs("#logout").remove()
+    }
+}());
\ No newline at end of file
diff --git a/apps/bff-springboot3/src/main/resources/templates/app/index.html b/apps/bff-springboot3/src/main/resources/templates/app/index.html
new file mode 100644
index 00000000..83c116c2
--- /dev/null
+++ b/apps/bff-springboot3/src/main/resources/templates/app/index.html
@@ -0,0 +1,83 @@
+<!doctype html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport"
+          content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">
+    <meta http-equiv="X-UA-Compatible" content="ie=edge">
+    <meta name="_csrf" th:content="${_csrf.token}"/>
+    <meta name="_csrf_header" th:content="${_csrf.headerName}"/>
+    <title>SPA BFF3 Demo</title>
+
+    <script>
+        (function checkLoginState() {
+
+            function enableInactivityMonitoring() {
+
+                var hidden, visibilityChange;
+                if (typeof document.hidden !== "undefined") { // Opera 12.10 and Firefox 18 and later support
+                    hidden = "hidden";
+                    visibilityChange = "visibilitychange";
+                } else if (typeof document.msHidden !== "undefined") {
+                    hidden = "msHidden";
+                    visibilityChange = "msvisibilitychange";
+                } else if (typeof document.webkitHidden !== "undefined") {
+                    hidden = "webkitHidden";
+                    visibilityChange = "webkitvisibilitychange";
+                }
+
+                function handleVisibilityChange(event) {
+
+                    if (document[hidden]) {
+                        return;
+                    }
+
+                    fetch("/bff/auth/check-session", {credentials: 'include', redirect: 'follow'})
+                        .then(function (response) {
+                            if (!response.ok && response.status == 401) {
+                                window.location.reload();
+                                return;
+                            }
+
+                            if (response.redirected) {
+                                window.location.href = response.url;
+                                return;
+                            }
+                        });
+                }
+
+                if (!(typeof document.addEventListener === "undefined" || hidden === undefined)) {
+                    document.addEventListener(visibilityChange, handleVisibilityChange, false);
+                }
+            }
+
+            function onDomContentLoaded() {
+                enableInactivityMonitoring();
+            }
+
+            document.addEventListener('DOMContentLoaded', evt => onDomContentLoaded());
+        })();
+
+    </script>
+</head>
+<body>
+
+<a href="/bff/" id="login">login</a>
+<a href="#" id="logout" onclick="logoutForm.submit(); return false;">Logout</a>
+
+<form id="logoutForm" th:action="@{/logout}" method="POST">
+    <!--/* CSRF token will be emitted by Spring Security */-->
+</form>
+
+<div id="app">
+    <div id="username"><span sec:authentication="name">Anonymous</span></div>
+    <pre id="userInfo"></pre>
+</div>
+
+
+<script defer th:src="@{${appScript}}">
+
+</script>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/apps/bff-springboot3/src/test/java/demo/BffSpringboot3ApplicationTests.java b/apps/bff-springboot3/src/test/java/demo/BffSpringboot3ApplicationTests.java
new file mode 100644
index 00000000..52b018b7
--- /dev/null
+++ b/apps/bff-springboot3/src/test/java/demo/BffSpringboot3ApplicationTests.java
@@ -0,0 +1,13 @@
+package demo;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.boot.test.context.SpringBootTest;
+
+@SpringBootTest
+class BffSpringboot3ApplicationTests {
+
+	@Test
+	void contextLoads() {
+	}
+
+}
diff --git a/pom.xml b/pom.xml
index b9c094cb..b5cc2078 100644
--- a/pom.xml
+++ b/pom.xml
@@ -23,6 +23,7 @@
         <module>apps/frontend-webapp-springboot</module>
         <module>apps/frontend-webapp-springboot3</module>
         <module>apps/bff-springboot</module>
+        <module>apps/bff-springboot3</module>
         <module>apps/jwt-client-authentication</module>
         <!--        <module>keycloak/patches/keycloak-model-infinispan-patch</module>-->
 <!--        <module>keycloak/patches/wildfly-clustering-infinispan-extension-patch-25.0.x</module>-->
@@ -67,4 +68,14 @@
         <maven-failsafe-plugin.version>2.22.2</maven-failsafe-plugin.version>
         <maven-surefire-plugin.version>2.22.2</maven-surefire-plugin.version>
     </properties>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <version>3.11.0</version>
+            </plugin>
+        </plugins>
+    </build>
 </project>
\ No newline at end of file