{"record":{"id":"01f84d7cc835852b","repo":"dotnet/aspnetcore","slug":"authorization-requires-a-cascading-parameter-of-ty","errorCode":null,"errorMessage":"Authorization requires a cascading parameter of type Task<AuthenticationState>. Consider using CascadingAuthenticationState to supply this.","messagePattern":"Authorization requires a cascading parameter of type Task<AuthenticationState>\\. Consider using CascadingAuthenticationState to supply this\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"critical","filePath":"src/Components/Authorization/src/AuthorizeViewCore.cs","lineNumber":85,"sourceCode":"        {\n            builder.AddContent(0, NotAuthorized?.Invoke(currentAuthenticationState!));\n        }\n    }\n\n    /// <inheritdoc />\n    protected override async Task OnParametersSetAsync()\n    {\n        // We allow 'ChildContent' for convenience in basic cases, and 'Authorized' for symmetry\n        // with 'NotAuthorized' in other cases. Besides naming, they are equivalent. To avoid\n        // confusion, explicitly prevent the case where both are supplied.\n        if (ChildContent != null && Authorized != null)\n        {\n            throw new InvalidOperationException($\"Do not specify both '{nameof(Authorized)}' and '{nameof(ChildContent)}'.\");\n        }\n\n        if (AuthenticationState == null)\n        {\n            throw new InvalidOperationException($\"Authorization requires a cascading parameter of type Task<{nameof(AuthenticationState)}>. Consider using {typeof(CascadingAuthenticationState).Name} to supply this.\");\n        }\n\n        // Clear the previous result of authorization\n        // This will cause the Authorizing state to be displayed until the authorization has been completed\n        isAuthorized = null;\n\n        currentAuthenticationState = await AuthenticationState;\n        isAuthorized = await IsAuthorizedAsync(currentAuthenticationState.User);\n    }\n\n    /// <summary>\n    /// Gets the data required to apply authorization rules.\n    /// </summary>\n    protected abstract IAuthorizeData[]? GetAuthorizeData();\n\n    internal virtual object[]? GetAuthorizationMetadata() => GetAuthorizeData();\n\n    private async Task<bool> IsAuthorizedAsync(ClaimsPrincipal user)","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/dotnet/aspnetcore/blob/294cab2f9b2e03af6b953820c7ab497c3c8b7ad9/src/Components/Authorization/src/AuthorizeViewCore.cs#L67-L103","documentation":"Thrown by AuthorizeViewCore.OnParametersSetAsync when the [CascadingParameter] Task<AuthenticationState> resolves to null. AuthorizeView/AuthorizeRouteView depend on a cascading authentication state to determine the current user; without it, authorization cannot be evaluated. The fix is to wrap the component hierarchy (typically in App.razor or Routes.razor) with <CascadingAuthenticationState> or register an AuthenticationStateProvider in DI.","triggerScenarios":"Using <AuthorizeView>, <AuthorizeRouteView>, or [Authorize] on a page without a CascadingAuthenticationState ancestor and without AddAuthentication/AddAuthorization wiring that provides an AuthenticationStateProvider. The check is at AuthorizeViewCore.cs:83-86.","commonSituations":"New Blazor project missing the <CascadingAuthenticationState> wrapper in App.razor; migrating a server-rendered app to interactive without registering AuthenticationStateProvider; using AuthorizeView in a test or isolated component host that doesn't set up the auth cascade.","solutions":["Wrap your root component (App or Routes) with <CascadingAuthenticationState>...</CascadingAuthenticationState>.","Ensure AddAuthorization() and an AuthenticationStateProvider are registered in the DI container (e.g., AddServerAuthentication or AddCustomAuth).","If using Blazor Web App, verify the AuthenticationStateProvider is configured in Program.cs."],"exampleFix":"// before (App.razor)\n<Router AppAssembly=\"@typeof(Program).Assembly\">\n    <Found Context=\"routeData\">\n        <RouteView RouteData=\"@routeData\" />\n    </Found>\n</Router>\n\n// after\n<CascadingAuthenticationState>\n    <Router AppAssembly=\"@typeof(Program).Assembly\">\n        <Found Context=\"routeData\">\n            <AuthorizeRouteView RouteData=\"@routeData\" />\n        </Found>\n    </Router>\n</CascadingAuthenticationState>","handlingStrategy":"validation","validationCode":"// At startup, verify auth is wired\nvar authStateProvider = serviceProvider.GetService<AuthenticationStateProvider>();\nif (authStateProvider is null)\n{\n    throw new InvalidOperationException(\"Register AuthenticationStateProvider and wrap root with CascadingAuthenticationState.\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always wrap App.razor / Routes.razor with <CascadingAuthenticationState> when using AuthorizeView.","Call AddAuthorization() in Program.cs for any Blazor project using auth.","Write a smoke test that renders an <AuthorizeView> to catch missing cascade early."],"tags":["blazor","authorization","authentication","cascading-parameter"],"analyzedSha":"294cab2f9b2e03af6b953820c7ab497c3c8b7ad9","analyzedAt":"2026-08-06T20:08:02.189Z","schemaVersion":2},"datasetVersion":"2026-08-06T23:17:07.152Z"}