{"record":{"id":"1a277a5c846c42df","repo":"dotnet/aspnetcore","slug":"could-not-load-settings-from-settings-configura","errorCode":null,"errorMessage":"Could not load settings from '${settings.configurationEndpoint}'","messagePattern":"Could not load settings from '(.+?)'","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/Components/WebAssembly/WebAssembly.Authentication/src/Interop/AuthenticationService.ts","lineNumber":491,"sourceCode":"    }\n\n    public static async completeSignOut(url: string) {\n        let operation = this._pendingOperations[url];\n        if (!operation) {\n            operation = AuthenticationService.instance.completeSignOut(url);\n            await operation;\n            delete this._pendingOperations[url];\n        }\n\n        return operation;\n    }\n\n    private static async createUserManager(settings: OidcAuthorizeServiceSettings): Promise<UserManager> {\n        let finalSettings: UserManagerSettings;\n        if (isApiAuthorizationSettings(settings)) {\n            const response = await fetch(settings.configurationEndpoint);\n            if (!response.ok) {\n                throw new Error(`Could not load settings from '${settings.configurationEndpoint}'`);\n            }\n\n            const downloadedSettings = await response.json();\n\n            finalSettings = downloadedSettings;\n        } else {\n            if (!settings.scope) {\n                settings.scope = settings.defaultScopes.join(' ');\n            }\n\n            if (settings.response_type === null) {\n                // If the response type is not set, it gets serialized as null. OIDC-client behaves differently than when the value is undefined, so we explicitly check for a null value and remove the property instead.\n                delete settings.response_type;\n            }\n\n            finalSettings = settings;\n        }\n","sourceCodeStart":473,"sourceCodeEnd":509,"githubUrl":"https://github.com/dotnet/aspnetcore/blob/294cab2f9b2e03af6b953820c7ab497c3c8b7ad9/src/Components/WebAssembly/WebAssembly.Authentication/src/Interop/AuthenticationService.ts#L473-L509","documentation":"Thrown by AuthenticationService.createUserManager() in the Oidc/ApiAuthorization interop (AuthenticationService.ts:491) when fetching the OIDC discovery/configuration document from settings.configurationEndpoint returns a non-OK HTTP response (!response.ok). The configuration endpoint (typically '/_configuration/{AppName}') returns the issuer, clientId, scopes, and metadata the oidc-client UserManager needs; without it the UserManager cannot be created, so the app cannot authenticate.","triggerScenarios":"fetch(settings.configurationEndpoint) returns a 4xx/5xx (e.g., 404 for a misnamed application, 500 from the server, or a redirect). The endpoint must return 200 with the OIDC settings JSON; any other status throws.","commonSituations":"Application name passed to AddOidc/ApiAuthorization does not match a registered client/config (404). Server not started or mis-routed so /_configuration/... 404s. Authentication not wired in Program.cs (endpoint missing). Reverse proxy stripping the path. Anti-forgery/CORS/auth middleware blocking the endpoint before it serves config. Running the client without the server host.","solutions":["Open settings.configurationEndpoint (e.g., /_configuration/YourApp) directly in a browser and confirm it returns 200 JSON; fix the 4xx/5xx shown.","Verify AddApiAuthorization/AddOidc uses the correct application/client name matching what the client requests.","Ensure app.MapFallback/MapControllerRoute and the authentication endpoints are registered in Program.cs and not shadowed.","Check that a reverse proxy rewrites the path correctly and that no auth middleware blocks the configuration route before it runs."],"exampleFix":"// before — wrong app name\nservices.AddApiAuthorization(options => { /* none */ });\nBlazor.start({ configure: c => c.Settings.configurationEndpoint = '/_configuration/WrongName' });\n\n// after\nservices.AddApiAuthorization(\"CorrectName\", ...);\n// fetch /_configuration/CorrectName → 200 OK with OIDC config","handlingStrategy":"try-catch","validationCode":"async function configurationAvailable(endpoint: string): Promise<boolean> {\n  try { const r = await fetch(endpoint); return r.ok; } catch { return false; }\n}","typeGuard":null,"tryCatchPattern":"try {\n  await AuthenticationService.init(...);\n} catch (e) {\n  if (/Could not load settings/i.test(e.message)) {\n    console.error('OIDC config endpoint failed — check /_configuration/<AppName>');\n  }\n  throw e;\n}","preventionTips":["Hit /_configuration/<AppName> in a browser to confirm 200 before booting.","Use the exact application name registered via AddApiAuthorization/AddOidc.","Ensure auth endpoints are mapped and not shadowed by routing.","Verify reverse proxy path rewriting."],"tags":["authentication","oidc","blazor","configuration","network","startup"],"analyzedSha":"294cab2f9b2e03af6b953820c7ab497c3c8b7ad9","analyzedAt":"2026-08-06T20:08:02.189Z","schemaVersion":2},"datasetVersion":"2026-08-06T23:17:07.152Z"}