dotnet/aspnetcore · critical · InvalidOperationException

Authorization requires a cascading parameter of type Task<Au

Error message

Authorization requires a cascading parameter of type Task<AuthenticationState>. Consider using CascadingAuthenticationState to supply this.

What it means

Thrown by AuthorizeViewCore.OnParametersSetAsync when the [CascadingParameter] Task<AuthenticationState> resolves to null. AuthorizeView/AuthorizeRouteView depend on a cascading authentication state to determine the current user; without it, authorization cannot be evaluated. The fix is to wrap the component hierarchy (typically in App.razor or Routes.razor) with <CascadingAuthenticationState> or register an AuthenticationStateProvider in DI.

Source

Thrown at src/Components/Authorization/src/AuthorizeViewCore.cs:85

        {
            builder.AddContent(0, NotAuthorized?.Invoke(currentAuthenticationState!));
        }
    }

    /// <inheritdoc />
    protected override async Task OnParametersSetAsync()
    {
        // We allow 'ChildContent' for convenience in basic cases, and 'Authorized' for symmetry
        // with 'NotAuthorized' in other cases. Besides naming, they are equivalent. To avoid
        // confusion, explicitly prevent the case where both are supplied.
        if (ChildContent != null && Authorized != null)
        {
            throw new InvalidOperationException($"Do not specify both '{nameof(Authorized)}' and '{nameof(ChildContent)}'.");
        }

        if (AuthenticationState == null)
        {
            throw new InvalidOperationException($"Authorization requires a cascading parameter of type Task<{nameof(AuthenticationState)}>. Consider using {typeof(CascadingAuthenticationState).Name} to supply this.");
        }

        // Clear the previous result of authorization
        // This will cause the Authorizing state to be displayed until the authorization has been completed
        isAuthorized = null;

        currentAuthenticationState = await AuthenticationState;
        isAuthorized = await IsAuthorizedAsync(currentAuthenticationState.User);
    }

    /// <summary>
    /// Gets the data required to apply authorization rules.
    /// </summary>
    protected abstract IAuthorizeData[]? GetAuthorizeData();

    internal virtual object[]? GetAuthorizationMetadata() => GetAuthorizeData();

    private async Task<bool> IsAuthorizedAsync(ClaimsPrincipal user)

View on GitHub (pinned to 294cab2f9b)

Solutions

1. Wrap your root component (App or Routes) with <CascadingAuthenticationState>...</CascadingAuthenticationState>.
2. Ensure AddAuthorization() and an AuthenticationStateProvider are registered in the DI container (e.g., AddServerAuthentication or AddCustomAuth).
3. If using Blazor Web App, verify the AuthenticationStateProvider is configured in Program.cs.

Example fix

// before (App.razor)
<Router AppAssembly="@typeof(Program).Assembly">
    <Found Context="routeData">
        <RouteView RouteData="@routeData" />
    </Found>
</Router>

// after
<CascadingAuthenticationState>
    <Router AppAssembly="@typeof(Program).Assembly">
        <Found Context="routeData">
            <AuthorizeRouteView RouteData="@routeData" />
        </Found>
    </Router>
</CascadingAuthenticationState>

// At startup, verify auth is wired
var authStateProvider = serviceProvider.GetService<AuthenticationStateProvider>();
if (authStateProvider is null)
{
    throw new InvalidOperationException("Register AuthenticationStateProvider and wrap root with CascadingAuthenticationState.");
}

When it happens

Trigger: Using <AuthorizeView>, <AuthorizeRouteView>, or [Authorize] on a page without a CascadingAuthenticationState ancestor and without AddAuthentication/AddAuthorization wiring that provides an AuthenticationStateProvider. The check is at AuthorizeViewCore.cs:83-86.

Common situations: New Blazor project missing the <CascadingAuthenticationState> wrapper in App.razor; migrating a server-rendered app to interactive without registering AuthenticationStateProvider; using AuthorizeView in a test or isolated component host that doesn't set up the auth cascade.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Failed to retrieve token, no account found.
• Scopes not granted.
• Could not load settings from '${settings.configurationEndpoi
• The server responded with status ${response.status}.
• Do not specify both 'Authorized' and 'ChildContent'.

AI-assisted analysis of dotnet/aspnetcore@294cab2f9b (2026-08-06). Data as JSON: /api/errors/01f84d7cc835852b. Report an issue: GitHub.