Blazor Web Assembly authentication issue in version 10.0.8

Question

Blazor Web Assembly authentication issue in version 10.0.8

Muthukumar S 0

0 comments

4 answers

Your answer

Answer 1

Muthukumar S 0

@Danny Nguyen (WICLOUD CORPORATION) Replacing manually the AuthenticationService.js in 10.0.8 with the version from 10.0.7 works correctly with the 10.0.8 runtime, without any other changes. It looks like issue in the java script layer. Please share your thoughts on this. Thanks.

0 comments

Answer 2

Muthukumar S 0

@Danny Nguyen (WICLOUD CORPORATION) Thank you for your response. I am currently using .NET SDK 10.0.300 along with MSAL 10.0.8. Could there be any version compatibility issues or potential lifecycle regressions contributing to this behavior?

I have also observed that AuthenticationService.js is not being executed during the login process, and the RemoteUserAccount object is returning null values. Interestingly, the same setup works as expected with runtime version 10.0.7 on the same SDK.

I would appreciate your insights on this. Thank you.

0 comments

Answer 3

Danny Nguyen (WICLOUD CORPORATION) 6,945 Microsoft External Staff Moderator

Hi @Muthukumar S , could you share a bit more detail about the issue? For example, what authentication setup/provider you’re using, the exact error or behavior you’re seeing, and whether this started only after updating to 10.0.8.

In the meantime, these docs may help with common Blazor WebAssembly authentication setup and troubleshooting:

Blazor WebAssembly security/authentication overview: https://learn.microsoft.com/en-us/aspnet/core/blazor/security/webassembly/?view=aspnetcore-10.0
Blazor WebAssembly additional security scenarios: https://learn.microsoft.com/en-us/aspnet/core/blazor/security/webassembly/additional-scenarios?view=aspnetcore-10.0
Hosted Blazor WebAssembly with Microsoft Entra ID: https://learn.microsoft.com/en-us/aspnet/core/blazor/security/webassembly/hosted-with-microsoft-entra-id?view=aspnetcore-7.0
Blazor WebAssembly with ASP.NET Core Identity: https://learn.microsoft.com/en-us/aspnet/core/blazor/security/webassembly/standalone-with-identity/?view=aspnetcore-10.0
ASP.NET Core authentication overview: https://learn.microsoft.com/en-us/aspnet/core/security/authentication/?view=aspnetcore-10.0

If you can share the error message, browser console output, or relevant authentication configuration, it will be easier to suggest specific troubleshooting step.

Muthukumar S 0 Reputation points

2026-05-29T03:44:57.2066667+00:00

Hi @Danny Nguyen (WICLOUD CORPORATION) Thanks for your response. I am using MSAL authentication, and after upgrading to version 10.0.8, the RemoteUserAccount is always null in the CreateUserAsync method within my ClaimFactory. The same configuration works perfectly up to version 10.0.7 using the same Visual Studio (v18.6.1). This issue is occurring only after the upgrade. So the Authentication is not working.
Danny Nguyen (WICLOUD CORPORATION) 6,945 Reputation points Microsoft External Staff Moderator

2026-05-29T10:48:26.31+00:00
Hi @Muthukumar S , thank you for your follow up. I tested this with a clean Blazor WebAssembly + MSAL repro and wasn’t able to reproduce a general 10.0.8 regression.

What I observed is that CreateUserAsync can be called during the initial unauthenticated flow with RemoteUserAccount == null, and then called again after a successful sign-in with a populated account. In my test on 10.0.8, the post-login call had a non-null RemoteUserAccount, so authentication completed successfully.

Because of that, a custom AccountClaimsPrincipalFactory<RemoteUserAccount> should defensively handle the unauthenticated case, for example:

public override ValueTask<ClaimsPrincipal> CreateUserAsync( RemoteUserAccount account, RemoteAuthenticationUserOptions options) { if (account is null) { return base.CreateUserAsync(account, options); } // custom claim logic here return base.CreateUserAsync(account, options); }

If you can share a minimal repro or the custom claim-mapping code, that would help narrow down your problem.
Muthukumar S 0 Reputation points

2026-06-01T02:02:58.0266667+00:00

@Danny Nguyen (WICLOUD CORPORATION) Thanks for your response. I am using dotnet SDK 10.0.300 and MSAL 10.0.8. Is there any version mismatch or any possible lifecycle regression. Because 10.0.7 run time is working fine with the same SDK.
Danny Nguyen (WICLOUD CORPORATION) 6,945 Reputation points Microsoft External Staff Moderator

2026-06-01T10:59:18.71+00:00
Hi @Muthukumar S , I wasn’t able to reproduce a general compatibility issue between SDK 10.0.300 and MSAL 10.0.8 in a minimal repro, so this may be specific to your app or auth flow.

Could you share the following so I can compare it with a working sample?

Program.cs

your custom AccountClaimsPrincipalFactory<RemoteUserAccount> implementation

your .csproj package versions

any custom AuthenticationService.js or related auth script changes

whether RemoteUserAccount is null only before sign-in, or still null after the login callback completes

A minimal repro would be even better if you can provide one.
Danny Nguyen (WICLOUD CORPORATION) 6,945 Reputation points Microsoft External Staff Moderator

2026-06-03T07:07:20.1066667+00:00

Hi, just checking in. Do you have any update on this post?

Answer 4

In 10.0.8 the most common causes for IsAuthenticated == false and RemoteUserAccount == null after an upgrade are configuration or package coherence issues in the Blazor WebAssembly authentication stack.

Use the following checks and fixes:

Verify identity provider (OIDC/MSAL) configuration

Confirm that all OIDC settings still match the provider app registration:
- Authority / Instance
- Tenant ID / Tenant domain
- Client ID
- Redirect URI
- Scopes and API permissions
A mismatch in any of these (for example, redirect URI or port) prevents the token from being issued and processed, which leaves the user unauthenticated.
If the app is running on a different port than configured in the redirect URI, update the provider configuration or the app so they match.

Inspect logs and network traffic

Enable client-side authentication logging for Blazor WebAssembly as described in the Blazor logging guidance. This will show whether the OIDC flow completes and whether tokens are received.
Use the browser’s developer tools Network tab to inspect the authentication redirects and token responses. Look for error responses from the identity provider or backend.

Check for incoherent packages after upgrading to 10.0.8 A functioning app can fail immediately after upgrading the .NET SDK or changing package versions due to incoherent packages.

Apply the recommended cleanup steps:

Clear NuGet caches:
```
   dotnet nuget locals all --clear
```
Delete the project’s bin and obj folders.
Restore and rebuild the project.
If deployed, delete all files in the deployment folder on the server before redeploying.

Also ensure that all Blazor and authentication-related packages target the same framework and are compatible with .NET 10.0.8. Using package versions incompatible with the app’s target framework isn’t supported.

Confirm the authentication pipeline still runs

Ensure the Blazor WebAssembly app still uses the Microsoft.AspNetCore.Components.WebAssembly.Authentication library and that the OIDC authentication process is wired as expected (login page /authentication/login, callback /authentication/login-callback, etc.).
If the authentication JavaScript (AuthenticationService.js) or MSAL version was customized or replaced, verify that the custom implementation still matches the 10.0.8 expectations. If a custom AuthenticationService is used, confirm the script reference is correct and loads before blazor.webassembly.js.

Validate the token itself

Once a token is obtained, decode it using https://jwt.ms to confirm it contains the expected claims and that it is valid (issuer, audience, expiry). If the token is missing or invalid, the authentication state will remain unauthenticated.

If after these steps IsAuthenticated remains false, focus on:

Logs from the client-side authentication library.
Network traces around /authentication/login and /authentication/login-callback.
Any differences in configuration or package versions introduced between 10.0.7 and 10.0.8.

References:

Share via

Blazor Web Assembly authentication issue in version 10.0.8

4 answers

Your answer