title: "There was an error trying to log you in: '' " Blazor WebAssembly using IdentiyServer Authentication
body: <p>I have a Blazor WebAssembly app using IdentityServer that comes with the template as my authentication service. I am having an issue where some users are seeing &quot;There was an error trying to log you in: ''&quot; once they try to login. I had users clear cookies and cache, and they are still experiencing this problem in all their browsers. The weird thing is that most users are able to login, but only a small percent is getting that error. Another odd thing is that it seems like if they use another device such as a phone, another pc, or ipad it works. What could be causing this issue? I have been having trouble trying to debug this issue as I am not able to replicate it on my end and so far not seeing any logs to get any info.</p>
  <p>This app is hosted in Google Cloud Platform using linux Docker container.</p>
  <p>Thank you in advance</p>
  <p>Edit: Here is my startup class</p>
  <pre><code>public class Startup
  {
      public Startup(IConfiguration configuration)
      {
          Configuration = configuration;
      }
  
      public IConfiguration Configuration { get; }
  
      readonly string MyAllowSpecificOrigins = &quot;_myAllowSpecificOrigins&quot;;
      private const string XForwardedPathBase = &quot;X-Forwarded-PathBase&quot;;
      private const string XForwardedProto = &quot;X-Forwarded-Proto&quot;;
  
      // This method gets called by the runtime. Use this method to add services to the container.
      // For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=398940
      public void ConfigureServices(IServiceCollection services)
      {
          services.AddCors(options =&gt;
          {
              options.AddPolicy(name: MyAllowSpecificOrigins,
                                builder =&gt;
                                {
                                    builder.WithOrigins(&quot;https://www.fakedomainexample.com&quot;,
                                                        &quot;https://fakedomainexample.com&quot;);
                                });
          });
  
          services.AddHttpContextAccessor();
  
          services.AddDbContext&lt;ApplicationDbContext&gt;(options =&gt;
              options.UseMySql(
                  Configuration.GetConnectionString(&quot;ConnectionString&quot;)));
  
          services.AddDefaultIdentity&lt;ApplicationUser&gt;(options =&gt; options.SignIn.RequireConfirmedAccount = true)
              .AddRoles&lt;IdentityRole&gt;()
              .AddEntityFrameworkStores&lt;ApplicationDbContext&gt;();
  
          // For some reason, I need to explicitly assign the IssuerUri or else site gets invalid_issuer error
          services.AddIdentityServer(x =&gt; x.IssuerUri = &quot;https://www.fakedomainexample.com&quot;).AddApiAuthorization&lt;ApplicationUser, ApplicationDbContext&gt;(options =&gt; {
              options.IdentityResources[&quot;openid&quot;].UserClaims.Add(&quot;name&quot;);
              options.ApiResources.Single().UserClaims.Add(&quot;name&quot;);
              options.IdentityResources[&quot;openid&quot;].UserClaims.Add(&quot;role&quot;);
              options.ApiResources.Single().UserClaims.Add(&quot;role&quot;);
          });
          JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Remove(&quot;role&quot;);
  
          services.Configure&lt;IdentityOptions&gt;(options =&gt;
          {
              // Password settings.
              options.Password.RequireDigit = true;
              options.Password.RequireLowercase = true;
              options.Password.RequireNonAlphanumeric = true;
              options.Password.RequireUppercase = true;
              options.Password.RequiredLength = 8;
              options.Password.RequiredUniqueChars = 1;
  
              // User settings.
              options.User.AllowedUserNameCharacters = &quot;abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789&quot;;
              options.User.RequireUniqueEmail = true;
              options.SignIn.RequireConfirmedAccount = false;
          });
  
          // Added Cookie options below to fix an issue with login redirect in Chrome for http
          // https://stackoverflow.com/questions/60757016/identity-server-4-post-login-redirect-not-working-in-chrome-only
          // This one worked: https://stackoverflow.com/questions/63449387/cannot-redirect-back-to-angular-client-after-login-in-identity-server
          services.ConfigureExternalCookie(option =&gt;
          {
              option.LoginPath = &quot;/Account/Login&quot;;
              option.Cookie.IsEssential = true;
              option.Cookie.SameSite = SameSiteMode.Lax;
          });
          services.ConfigureApplicationCookie(option =&gt;
          {
              option.LoginPath = &quot;/Account/Login&quot;;
              option.Cookie.IsEssential = true;
              option.Cookie.SameSite = SameSiteMode.Lax;
          });
  
  
          services.AddAuthentication()
              .AddIdentityServerJwt();
  
          services.AddControllersWithViews();
          services.AddRazorPages();
      }
  
      // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
      public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
      {
          app.UseForwardedHeaders(new ForwardedHeadersOptions
          {
              ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
          });
  
          app.UseRewriter(new RewriteOptions()
              .AddRedirectToWwwPermanent());
  
          if (env.IsDevelopment())
          {
              app.UseDeveloperExceptionPage();
              app.UseDatabaseErrorPage();
              app.UseWebAssemblyDebugging();
          }
          else
          {
              app.UseExceptionHandler(&quot;/Error&quot;);
              // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
              app.UseHsts();
          }
          app.Use((context, next) =&gt;
          {
              if (context.Request.Headers.TryGetValue(XForwardedPathBase, out StringValues pathBase))
              {
                  context.Request.PathBase = new PathString(pathBase);
              }
  
              if (context.Request.Headers.TryGetValue(XForwardedProto, out StringValues proto))
              {
                  context.Request.Scheme = proto;
              }
          //context.SetIdentityServerOrigin(&quot;https://www.fakedomainexample.com&quot;); 
          return next();
          });
          app.UseHttpsRedirection();
          app.UseBlazorFrameworkFiles();
          
          const string cacheMaxAge = &quot;3600&quot;;
          app.UseStaticFiles(new StaticFileOptions
          {
              OnPrepareResponse = ctx =&gt;
              {
                  ctx.Context.Response.Headers.Add(&quot;Cache-Control&quot;, $&quot;public, max-age={cacheMaxAge}&quot;);
              }
          });
          app.UseCookiePolicy(new CookiePolicyOptions
          {
              MinimumSameSitePolicy = Microsoft.AspNetCore.Http.SameSiteMode.Lax,
          });
  
          app.UseRouting();
          app.UseCors(MyAllowSpecificOrigins);
  
          app.UseIdentityServer();
          app.UseAuthentication();
          app.UseAuthorization();
  
          app.UseEndpoints(endpoints =&gt;
          {
              endpoints.MapRazorPages();
              endpoints.MapControllers();
              endpoints.MapFallbackToFile(&quot;index.html&quot;);
          });
      }
  }
  </code></pre>