title: "Blocked loading mixed active content" in Blazor WebAssembly app which uses IdentityServer4
body: <p>I'm trying to run default Blazor WebAssembly project template on my web server. Project, when ran locally, works without any problems. Problem appears after I deploy it to server.</p>
  
  <p>I can successfully navigate to any page that doesn't require authentication. However, when I try to enter the one requiring login, I can see such message:</p>
  
  <blockquote>
    <p>There was an error trying to log you in: 'Network Error'</p>
  </blockquote>
  
  <p><a href="https://i.stack.imgur.com/2aFev.png" rel="noreferrer"><img src="https://i.stack.imgur.com/2aFev.png" alt="enter image description here"></a></p>
  
  <p>In web browser console I can see:</p>
  
  <blockquote>
    <p>Blocked loading mixed active content “<a href="http://[subdomain.domain.com]/.well-known/openid-configuration" rel="noreferrer">http://[subdomain.domain.com]/.well-known/openid-configuration</a>”</p>
  </blockquote>
  
  <p>In Firefox's "Network" tab, request is marked as "Blocked".</p>
  
  <p>My webserver runs on Nginx which acts as reverse proxy. I planned to keep HTTPS encryption configured between internet and Nginx. Communication between Nginx and other services were meant to be over plain HTTP. Here is my Nginx config:</p>
  
  <pre><code>server {
          listen 80;
  
          location / {
              return 301 https://$host$request_uri;
          }
      }
  
  [...]
  server {
          listen 443 ssl http2;
          listen [::]:443 ssl http2;
          server_name subdomain.domain.com;
  
          ssl_certificate /etc/nginx_ssl/live/fullchain.pem;
          ssl_certificate_key /etc/nginx_ssl/live/privkey.pem;
          ssl_session_cache builtin:1000 shared:SSL:10m;
          ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
          ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
          ssl_prefer_server_ciphers on;
  
          location / {
              proxy_pass http://blazorapp:80;
              proxy_redirect off;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $scheme;
              proxy_set_header X-Forwarded-Host $server_name;
  
              proxy_http_version 1.1;
              proxy_set_header Upgrade $http_upgrade;
              proxy_set_header Connection $connection_upgrade;
              proxy_set_header Host $host;
              proxy_cache_bypass $http_upgrade;
          }
      }
  </code></pre>
  
  <h3>My guesses</h3>
  
  <p>As you can see from browser error message, browser tries to access <code>.well-known/openid-configuration</code> over HTTP, not HTTPS. The problem possibly lays here.</p>
  
  <p>Do you have any ideas what could be wrong?</p>