{"record":{"id":"d7b71564ad2bb13a","repo":"dotnet/aspnetcore","slug":"the-server-responded-with-status-response-status","errorCode":null,"errorMessage":"The server responded with status ${response.status}.","messagePattern":"The server responded with status (.+?)\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/ProjectTemplates/Web.ProjectTemplates/content/BlazorWeb-CSharp/BlazorWebCSharp.1/Components/Account/Shared/PasskeySubmit.razor.js","lineNumber":15,"sourceCode":"const browserSupportsPasskeys =\n    typeof navigator.credentials !== 'undefined' &&\n    typeof window.PublicKeyCredential !== 'undefined' &&\n    typeof window.PublicKeyCredential.parseCreationOptionsFromJSON === 'function' &&\n    typeof window.PublicKeyCredential.parseRequestOptionsFromJSON === 'function';\n\nasync function fetchWithErrorHandling(url, options = {}) {\n    const response = await fetch(url, {\n        credentials: 'include',\n        ...options\n    });\n    if (!response.ok) {\n        const text = await response.text();\n        console.error(text);\n        throw new Error(`The server responded with status ${response.status}.`);\n    }\n    return response;\n}\n\nasync function createCredential(signal) {\n    const optionsResponse = await fetchWithErrorHandling('/Account/PasskeyCreationOptions', {\n        method: 'POST',\n        signal,\n    });\n    const optionsJson = await optionsResponse.json();\n    const options = PublicKeyCredential.parseCreationOptionsFromJSON(optionsJson);\n    return await navigator.credentials.create({ publicKey: options, signal });\n}\n\nasync function requestCredential(email, mediation, signal) {\n    const optionsResponse = await fetchWithErrorHandling(`/Account/PasskeyRequestOptions?username=${email}`, {\n        method: 'POST',\n        signal,","sourceCodeStart":1,"sourceCodeEnd":33,"githubUrl":"https://github.com/dotnet/aspnetcore/blob/294cab2f9b2e03af6b953820c7ab497c3c8b7ad9/src/ProjectTemplates/Web.ProjectTemplates/content/BlazorWeb-CSharp/BlazorWebCSharp.1/Components/Account/Shared/PasskeySubmit.razor.js#L1-L33","documentation":"Thrown by fetchWithErrorHandling in the PasskeySubmit component when an HTTP response to /Account/PasskeyCreationOptions or /Account/PasskeyRequestOptions has a non-2xx status. The wrapper attaches credentials:'include', reads the body for console logging, and rethrows a status-coded Error so the caller can react.","triggerScenarios":"Passkey creation or request flow hits a 4xx/5xx: 401 (not authenticated / cookie expired), 400 (malformed request, missing username), 500 (server-side passkey library error), 404 (anti-forgery/account endpoints misconfigured), 502/503 (reverse proxy).","commonSituations":"Session/auth cookie expired while the page sat idle; anti-forgery token missing or stale; the Account endpoints were customized/removed; rate limiting (429); the server's WebAuthn/fido2 library throwing.","solutions":["Inspect the logged response body in the browser console for the exact server error.","Verify the user is still authenticated; redirect to login on 401/403.","Confirm /Account/PasskeyCreationOptions and /Account/PasskeyRequestOptions are registered and anti-forgery is valid.","Check server logs for the 5xx root cause; ensure the fido2/WebAuthn server library is configured."],"exampleFix":"// before\n// no auth refresh; stale cookie -> 401\n\n// after\ntry {\n  await obtainCredential(...);\n} catch (e) {\n  if (/status 401|403/.test(e.message)) location.href = '/Account/Login?ReturnUrl=' + encodeURIComponent(location.pathname);\n}","handlingStrategy":"try-catch","validationCode":"async function fetchPasskeyOptions(url, signal) {\n  const r = await fetch(url, { method:'POST', credentials:'include', signal });\n  if (!r.ok) throw new Error('HTTP ' + r.status);\n  return r;\n}","typeGuard":"null","tryCatchPattern":"try { await obtainCredential(); } catch (e) {\n  const s = (e.message.match(/status (\\d+)/)||[])[1];\n  if (s === '401' || s === '403') location.href = '/Account/Login';\n  else showError(e.message);\n}","preventionTips":["Refresh auth before passkey flows that sat idle.","Keep anti-forgery tokens valid.","Read and log the response body for server-side detail."],"tags":["blazor","passkeys","webauthn","http","authentication","network"],"analyzedSha":"294cab2f9b2e03af6b953820c7ab497c3c8b7ad9","analyzedAt":"2026-08-06T20:08:02.189Z","schemaVersion":2},"datasetVersion":"2026-08-06T23:17:07.152Z"}