# Securing Blazor WebAssembly Apps **URL:** \ **Category:** Get Help\ **Tags:** dotnet, webassembly, .net, blazor\ **Created:** [July 21, 2020, 3:10pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661 "2020-07-21T15:10:03Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![gonsalvg](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/gonsalvg/32/13442_2.png) [@gonsalvg](https://community.auth0.com/u/gonsalvg)\ **Post date:** [August 28, 2020, 6:12pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/22 "2020-08-28T18:12:56Z")
Hey Andrea, thanks for the warm welcome! I have verified that the audience is defaulted just like the tutorial. Here is a screenshot of the login flow… [chrome log](https://imgur.com/a/EDOJKs6). The logs on the auth0 dash are a bit more confusing to me though, it does show a successful login but many more errors are happening for reasons I am not sure of. [logs](https://imgur.com/a/qCygxf5) End result being what you see in the first image. If there is any more info I can provide please let me know! ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [August 31, 2020, 10:18am UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/23 "2020-08-31T10:18:34Z")
Hi @gonsalvg, From what I can see from the screenshots you shared, an error occurs while getting the access token. However, I’m not able to figure out what the problem is. To get more info, you should: - take a look at the failing HTTP request from the dev tools of your browser, similarly to [how I reported the 401 issue in the article](https://cdn.auth0.com/blog/securing-blazor-webassembly/blazor-app-dev-tools-invalid-token.png) - expand the _Failed Exchange_ log entry in the Auth0 Dashboard Both actions should hopefully give us more information about what is going on. ---
**Author:** ![gonsalvg](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/gonsalvg/32/13442_2.png) [@gonsalvg](https://community.auth0.com/u/gonsalvg)\ **Post date:** [September 6, 2020, 3:06pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/24 "2020-09-06T15:06:35Z")
Hey again! In some strange turn of luck I managed to solve the issue somehow by switching the auth0 app type from SPA to “Normal Web Application” and then back again in its settings. ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [September 7, 2020, 6:44am UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/25 "2020-09-07T06:44:24Z")
Perfect! Glad to hear that @gonsalvg! ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [September 7, 2020, 7:30am UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/26 "2020-09-07T07:30:52Z")
Hey @gonsalvg, happy to hear you solved the issue! 💪 ---
**Author:** ![tkvision](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/tkvision/32/17944_2.png) [@tkvision](https://community.auth0.com/u/tkvision)\ **Post date:** [September 16, 2020, 5:32pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/27 "2020-09-16T17:32:29Z")
Found error ‘There was an error trying to log you in: ‘Invalid response Content-Type: text/html, from URL: [dev-xxxxx.us.auth0.com/.well-known/openid-configuration](http://dev-xxxxx.us.auth0.com/.well-known/openid-configuration)’’ ![Screen Shot 2563-09-16 at 23.15.07](https://global.discourse-cdn.com/auth0/original/3X/5/d/5d113a99ea5b7998f47b0f3f49c3663518cee5e0.png) ![Screen Shot 2563-09-16 at 23.14.52](https://global.discourse-cdn.com/auth0/original/3X/2/9/29806727e70652ec52f47f5be56afacc6faadd4f.png) ![Screen Shot 2563-09-16 at 23.14.27](https://global.discourse-cdn.com/auth0/original/3X/e/f/efb92f408fe8f9dce6e297778fa4c019287d0509.png) ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [September 17, 2020, 8:23am UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/28 "2020-09-17T08:23:26Z")
Hi @tkvision, welcome to Auth0 Community and thanks for reading this blog post. The error you reported seems to be related to an error page sent by the `/.well-known/openid-configuration` endpoint in place of the JSON configuration data. It may depend on a wrong configuration on the application side or on the Auth0 dashboard side. You should find more details on the specific error by taking a look at the _Log_ section in your Auth0 dashboard. If the error message you should find in the logs is not clear enough, please, share it with us. It could also be useful to capture the HTTP request that gets the error. See [here for more details on how to capture HTTP requests](https://auth0.com/docs/troubleshoot/generate-and-analyze-har-files). ---
**Author:** ![carlos.guarany](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/carlos.guarany/32/13315_2.png) [@carlos.guarany](https://community.auth0.com/u/carlos.guarany)\ **Post date:** [September 25, 2020, 5:16pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/29 "2020-09-25T17:16:28Z")
Is it possible to secure a client Blazor WASM SPA without the [asp.net](http://asp.net) core hosting? I mean I want to keep my existing [asp.net](http://asp.net) core API in a separate solution since it is already been consumed by other apps (Android and iOS). Thank you! ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [September 28, 2020, 8:10am UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/31 "2020-09-28T08:10:28Z")
Hey @carlos.guarany, Sure, you can create and secure your Blazor WASM app without hosting it in your [ASP.NET](http://ASP.NET) Core application. Your Blazor WASM app is like any other client app. Check out [this document for more information](https://docs.microsoft.com/en-us/aspnet/core/blazor/host-and-deploy/webassembly?view=aspnetcore-3.1#standalone-deployment). Keep in mind, however, that the current limitation for the audience parameter mentioned in the article still applies. ---
**Author:** ![carlos.guarany](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/carlos.guarany/32/13315_2.png) [@carlos.guarany](https://community.auth0.com/u/carlos.guarany)\ **Post date:** [September 28, 2020, 2:51pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/32 "2020-09-28T14:51:12Z")
Could you solve this problem? I have the same message. All the parameters are correct and there’s nothing on the Auth0 log to help. Thanks! ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [September 29, 2020, 8:59am UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/34 "2020-09-29T08:59:57Z")
Hi @carlos.guarany, To try to understand what is going on, I need at least the HTTP request sent to the server. As said to @tkvision, it seems that the app is receiving an error page (in HTML format) instead of the JSON configuration data. You can make a couple of tests: 1. Check if the URL `https://.auth0.com/.well-known/openid-configuration` is correct by navigating to it with a browser. 2. Make sure that you are assigning **the base URL of your Auth0 domain** (`https://`) to the `Authority` configuration key and not just your Auth0 domain (see [this](https://auth0.com/blog/securing-blazor-webassembly-apps/#Adding-Support-for-Authentication)). If those checks don’t solve, please, provide me with the HTTP request sent to the server. Let me know. ---
**Author:** ![carlos.guarany](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/carlos.guarany/32/13315_2.png) [@carlos.guarany](https://community.auth0.com/u/carlos.guarany)\ **Post date:** [September 29, 2020, 9:13pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/35 "2020-09-29T21:13:29Z")
Hi Andrea, You’re right, it was missing the “https://” for the Authority configuration. Thank you very much! Now the login page pops up but after inputting login/password, the app crashes with: There was an error fetching the SSO data. This is expected - and not a problem - if the tenant has Seamless SSO enabled. If the tenant doesn’t have Seamless SSO enabled, this could simply mean that there was a problem with the network. But, if a “Origin” error has been logged before this warning, please add “[https://your-auth0-domain](https://your-auth0-domain)” to the “Allowed Web Origins” list in the Auth0 dashboard I tried that but the error remains. The Auth0 log says “Successful Login” though. Thanks, Carlos ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [September 30, 2020, 9:00am UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/37 "2020-09-30T09:00:36Z")
Hey @carlos.guarany, Happy to hear you resolved the previous issue 🙂 Regarding this new one, if the Auth0 log says that the login was successful, it could be a problem with the callback URL. I would suggest you make the following checks: 1. Make sure that the `Allowed Callback URLs` field on the app settings in the Auth0 Dashboard matches the actual client address, including the protocol (`http` or `https`) 2. Try to download, configure, and run [the complete app from Github](https://github.com/auth0-blog/secure-blazor-wasm-quiz-manager) to understand if it is an issue with the code or with your Auth0 configuration. 3. If the above points don’t help, please, send us the HTTP request and response affected by the error. ---
**Author:** ![carlos.guarany](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/carlos.guarany/32/13315_2.png) [@carlos.guarany](https://community.auth0.com/u/carlos.guarany)\ **Post date:** [September 30, 2020, 4:24pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/38 "2020-09-30T16:24:49Z")
This time the configuration is fine and I am running the Github sample app. If the callback is wrong the login screen won’t show. I forgot to mention it worked fine for a couple of times before the first crash. I found some people with the same issues from old posts using different SPAs. They say they solved by adding this to the lock config: auth: { sso: false } I am afraid to break something on production since it’s been used for Android and iOS apps. I need to setup a totally different testing environment for that. Thanks, Carlos ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [October 1, 2020, 8:49am UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/39 "2020-10-01T08:49:04Z")
Please, let us know how your tests go and if we can help somewhat. ---
**Author:** ![paulkiddybytes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/paulkiddybytes/32/12809_2.png) [@paulkiddybytes](https://community.auth0.com/u/paulkiddybytes)\ **Post date:** [October 6, 2020, 3:49pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/40 "2020-10-06T15:49:40Z")
I’m getting the exact same error. My dashboard config appears to be correct and I’m using the example github project too. Haven’t tried my own even. Must be something odd going on here as a number of people are seeing the same issue… I’ve looked in the logs and I’m getting an “unauthorised” error. I have reset my password for the user account and tried again - still get the same problem. Logs me in, get the usual “allow access - green tick” box and after that the blazor app shows the same error… Occurred : 3 minutes ago at 2020-10-06 15:53:40.104 UTC Type : Failed Exchange Description : Unauthorized Seems to be a clear sequence of “Success Login” followed by “Failed Exchange” ![2020-10-06_17-23-08](https://global.discourse-cdn.com/auth0/original/3X/9/f/9fb858007035db400e4f7ad966f3c308d0615758.jpeg) ---
**Author:** ![paulkiddybytes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/paulkiddybytes/32/12809_2.png) [@paulkiddybytes](https://community.auth0.com/u/paulkiddybytes)\ **Post date:** [October 6, 2020, 4:57pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/41 "2020-10-06T16:57:01Z")
Would seem that this change has fixed it… Wasn’t mentioned in the original article as far as I could see… ![2020-10-06_17-56-07](https://global.discourse-cdn.com/auth0/original/3X/1/6/168615273bc34a6d1fe0bfa5abfd34cb190f8b5e.jpeg) ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [October 7, 2020, 11:56am UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/42 "2020-10-07T11:56:45Z")
Thanks for sharing it with the rest of community! ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [October 7, 2020, 12:47pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/44 "2020-10-07T12:47:30Z")
Hi @paulkiddybytes, the best way to understanding what’s going on is [to capture and analyze the HTTP requests and responses](https://auth0.com/docs/troubleshoot/generate-and-analyze-har-files) affected by the error. If you can provide us with them, we can try to understand what is happening. ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [October 7, 2020, 12:49pm UTC](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661/45 "2020-10-07T12:49:22Z")
As far as I know, you should not need this setting. I tested the sample app without it. [Previous page](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661.md?page=1) [Next page](https://community.auth0.com/t/securing-blazor-webassembly-apps/46661.md?page=3)