# RequireHttpsMetadata

**URL:** <https://community.auth0.com/t/requirehttpsmetadata/80172>\
**Category:** Get Help\
**Tags:** aspnet-core, .net, blazor\
**Created:** [March 19, 2022, 6:27pm UTC](https://community.auth0.com/t/requirehttpsmetadata/80172 "2022-03-19T18:27:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sean.feldman](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sean.feldman/32/34527_2.png) [@sean.feldman](https://community.auth0.com/u/sean.feldman)\
**Post date:** [March 19, 2022, 6:27pm UTC](https://community.auth0.com/t/requirehttpsmetadata/80172/1 "2022-03-19T18:27:18Z")

</div>

I’m building a Blazor WebAssembly (WASM) application hosted with [ASP.NET](http://ASP.NET) Core on .NET 6.  
In my attempt to deploy to Azure App Service (Windows), I’ve run into an issue with the Auth0 configuration working locally but failing in Azure. The error I’m getting:

```json
{
"type": "https://httpstatuses.com/500",
"title": "Internal Server Error",
"status": 500,
"detail": "The MetadataAddress or Authority must use HTTPS unless disabled for development by setting RequireHttpsMetadata=false."
}

```

After a quick search online, I’ve found a few posts where `JwtBearerOptions.RequireHttpsMetadata` ([link](https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.jwtbearer.jwtbeareroptions.requirehttpsmetadata?view=aspnetcore-6.0)) was set to false to resolve the issue. Reading the documentation, it states that this should **not** be done in production:

> Gets or sets if HTTPS is required for the metadata address or authority. The default is true. **This should be disabled only in development environments.**

My question is how to address this issue? Is this something on the Auth0 side or the tenant configuration?

---

<div class="post-metadata">

**Author:** ![sean.feldman](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sean.feldman/32/34527_2.png) [@sean.feldman](https://community.auth0.com/u/sean.feldman)\
**Post date:** [March 21, 2022, 5:13pm UTC](https://community.auth0.com/t/requirehttpsmetadata/80172/2 "2022-03-21T17:13:35Z")

</div>

~~After carefully reviewing the deployment, I’ve noticed that the `appsettings.json` values were overriding my Azure App Service Settings. To find that out, I had to add the following line to my `Program.cs`~~

```auto
IdentityModelEventSource.ShowPII = true; // DO NOT do this

```

~~This, essentially, has exposed the values that were used and pointed out the issue.~~

After going through more issues, finally can confirm that none of this is needed. The error message is **very** misleading.

> “The MetadataAddress or Authority must use HTTPS unless disabled for development by setting RequireHttpsMetadata=false.”

What is says is that MetadataAddress **or** Authority must use HTTPS. In my case, the setting for Authority was not coming through and the value was `null`. So rather than throwing an exception saying that Authority is null, this error was coming through.

Conclusion: check that the Audience value is coming through properly and do not set `RequireHttpsMetadata` to `false` as documentation states.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [March 21, 2022, 5:41pm UTC](https://community.auth0.com/t/requirehttpsmetadata/80172/3 "2022-03-21T17:41:00Z")

</div>

Thanks for the update!

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [March 31, 2022, 10:17am UTC](https://community.auth0.com/t/requirehttpsmetadata/80172/4 "2022-03-31T10:17:46Z")

</div>