# Securing Blazor WebAssembly Apps **URL:** \ **Category:** Get Help\ **Tags:** dotnet, webassembly, .net, blazor\ **Created:** [July 21, 2020, 3:10pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661 "2020-07-21T15:10:03Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![robertino.calcaterra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/robertino.calcaterra/32/66825_2.png) [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Post date:** [July 21, 2020, 3:10pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/1 "2020-07-21T15:10:03Z")
Learn how to secure Blazor WebAssembly applications with Auth0. [Read more](https://auth0.com/blog/securing-blazor-webassembly-apps/) Brought for you by @andrea.chiarelli ![Securing Blazor WebAssembly Apps](https://global.discourse-cdn.com/auth0/original/3X/a/e/ae48eb5e5f307da3698441e86f641ccc4048d77b.jpeg) ---
**Author:** ![robertino.calcaterra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/robertino.calcaterra/32/66825_2.png) [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Post date:** [July 21, 2020, 4:54pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/2 "2020-07-21T16:54:45Z")
What are you thoughts guys? Share it in the comments! šŸ’¬ ---
**Author:** ![afrank](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/afrank/32/18977_2.png) [@afrank](https://community.auth0.com/u/afrank)\ **Post date:** [July 22, 2020, 4:54pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/3 "2020-07-22T16:54:52Z")
Thanks for the article! What is the best way to add additional custom parameters to the login url? In Blazor server side you could modify a property in the OnRedirectToIdentityProvider event in options.Events when adding open id connect authentication in startup.cs to add these parameters but I donā€™t see a way to do this in wasmā€¦ ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [July 23, 2020, 8:23am UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/4 "2020-07-23T08:23:31Z")
Hi @afrank, The current implementation of `Microsoft.AspNetCore.Components.WebAssembly.Authentication` doesnā€™t support passing additional parameters, as [documented by this issue](https://github.com/dotnet/aspnetcore/issues/20813). This is the reason why you need to use a default audience to work around passing the `audience` parameter. ---
**Author:** ![afrank](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/afrank/32/18977_2.png) [@afrank](https://community.auth0.com/u/afrank)\ **Post date:** [July 23, 2020, 2:03pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/5 "2020-07-23T14:03:00Z")
Thanks for the answer @andrea.chiarelli! Hopefully they will add this in the future. ---
**Author:** ![lprada](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lprada/32/22766_2.png) [@lprada](https://community.auth0.com/u/lprada)\ **Post date:** [July 25, 2020, 2:44pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/6 "2020-07-25T14:44:00Z")
Hi @andrea.chiarelli the post was great. Can you write one to access de profile and claims? When there will be a SDK for blazor in Auth0? ---
**Author:** ![dane.vinson](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dane.vinson/32/12778_2.png) [@dane.vinson](https://community.auth0.com/u/dane.vinson)\ **Post date:** [July 30, 2020, 11:37pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/8 "2020-07-30T23:37:43Z")
First thank you for the article. A couple questions: The issue you mentioned about Blazorā€™s inability to provide additional query arguments at login would seem to suggest it is not possible to specify a particular Auth0 connection at login. Is there some way you can see to work around this and log in with a specified connection? When I log out the application appears to have logged me out but if I select the login link again Iā€™m immediately authenticated again without actually going through the login process. Something appears to be preserved in the application state that is not being cleared by logout. Any thoughts? ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [July 31, 2020, 7:37am UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/9 "2020-07-31T07:37:18Z")
Iā€™m sure Andrea will try to address that once heā€™s online. Thanks for all the input! ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [August 1, 2020, 6:43am UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/10 "2020-08-01T06:43:30Z")
Hey @dane.vinson, The `Authentication.razor` component implements logout by disconnecting the client from Auth0. However, as highlighted in a note in the article, it seems that in some circumstances the HTTP request to the logout endpoint doesnā€™t happen. I think it is a Blazor issue because this behavior is random on my side. ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [August 1, 2020, 7:02am UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/11 "2020-08-01T07:02:17Z")
Hi @lprada, thanks for appreciating it šŸ™‚ I will take into account your suggestion for a future blog post. Regarding an Auth0 SDK for Blazor, as far as I know, currently there is no plan for this. ---
**Author:** ![dane.vinson](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dane.vinson/32/12778_2.png) [@dane.vinson](https://community.auth0.com/u/dane.vinson)\ **Post date:** [August 7, 2020, 10:47pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/12 "2020-08-07T22:47:31Z")
In working through this article Iā€™ve found that when I assign the RemoteAuthenticationOptions.ProviderOptions.ResponseType to ā€œcodeā€ I get a 401 response with the message ā€œThere was an error trying to log you in: ā€˜ā€™ā€. If I do not assign the ResponseType (defaults to token?) the login succeeds, however, after successful login attempts access my API fail at the TryGetToken method. Inspection of the AccessTokenResult shows itā€™s Status is RequiredRedirect. Any thoughts on what I can try here? ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [August 10, 2020, 2:10pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/13 "2020-08-10T14:10:56Z")
Hey there @dane.vinson! Iā€™m sure Andrea will address that once heā€™s back from vacation. ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [August 11, 2020, 2:05pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/14 "2020-08-11T14:05:55Z")
Hey @dane.vinson, that behavior looks quite weird. Are you getting the same error even running [the complete project attached to the article](https://github.com/auth0-blog/secure-blazor-wasm-quiz-manager)? ---
**Author:** ![dane.vinson](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dane.vinson/32/12778_2.png) [@dane.vinson](https://community.auth0.com/u/dane.vinson)\ **Post date:** [August 11, 2020, 3:43pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/15 "2020-08-11T15:43:47Z")
When I created the Auth0 app I created it as a Regular Web Application instead of a Single Page Application. I updated that and got past the previous issues (though at this point Iā€™m still getting a 401 when I call a method on the Web API). ---
**Author:** ![dane.vinson](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dane.vinson/32/12778_2.png) [@dane.vinson](https://community.auth0.com/u/dane.vinson)\ **Post date:** [August 11, 2020, 4:57pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/16 "2020-08-11T16:57:52Z")
Iā€™ve downloaded the completed project, updated the ā€œAuthorityā€ and ā€œApiIdentifierā€ appsettings in the API project with my Auth0 authority and API identifier then updated the ā€œAuthorityā€ and ā€œClientIdā€ appsettings in the client project with my Auth0 authority and my applicationā€™s ClientId. I can log in with the client but I get 401 when trying to access the quiz endpoint. Also, after the 401 error in the browser I get a second, content type is not supported error, i.e. ā€œThe provided ContentType is not supported; the supported types are ā€˜application/jsonā€™ and the structured syntax suffix ā€˜application/+jsonā€™ā€. ---
**Author:** ![dane.vinson](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dane.vinson/32/12778_2.png) [@dane.vinson](https://community.auth0.com/u/dane.vinson)\ **Post date:** [August 11, 2020, 10:44pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/17 "2020-08-11T22:44:59Z")
I discovered that the Default Audience that Iā€™d provided in my Domain Settings did not actually save. I was finally able to get it to save after three consecutive times entering and saving and now both your POC and mine are working. ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [August 12, 2020, 1:03pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/18 "2020-08-12T13:03:09Z")
Thanks for providing all that context @dane.vinson! ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [August 12, 2020, 3:31pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/19 "2020-08-12T15:31:04Z")
Hey @dane.vinson, happy to hear you found the reason of the issue. ---
**Author:** ![gonsalvg](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/gonsalvg/32/13442_2.png) [@gonsalvg](https://community.auth0.com/u/gonsalvg)\ **Post date:** [August 26, 2020, 2:56am UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/20 "2020-08-26T02:56:36Z")
Thanks for the guide! I have tried following it as closely as possible and after double checking Iā€™m not quite sure why my implementation is failing logins, similarly to dane.vinson. After logging in through the universal login, I get redirected back to my app but am met with no change to the access control component and a message saying ā€œThere was an error logging you inā€. In the debug log I see two 401 errors, but Iā€™m not sure why. If anyone has any clues I would appreciate the assistance! ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [August 27, 2020, 8:03am UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/21 "2020-08-27T08:03:31Z")
Hi @gonsalvg, welcome to Auth0 Community! šŸ‘‹ Have you checked that your default audience is correctly saved on the Auth0 dashboard? That was [the issue for dane.vinson](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/17). Otherwise, please check more info in the logs in the Auth0 dashboard and/or share with us a detailed track of the HTTP request and response originating the issue. We will try to understand what is going on. [Next page](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661.md?page=2)