How to authenticate On IIS deployed blazor web app using azure entra ID (OIDC)

Question

Hello

I have created a Blazor web app in .NET 8. where I have a client and a server project. In this application I want to apply authentication through azure Entra ID.
and replicate the flow from https://github.com/dotnet/blazor-samples

and it is working when run my project on https profile through visual studio get authenticated, But I deployed my application on IIS and run the application then getting issue Sometimes it says

Too much large header 400 error

or

Says change the Asp net environment to development I have done this but did not work.

any help would be appreciated thanks.

Answer 1

When deploying a Blazor web app that uses Azure Entra ID for authentication on IIS, there are a few common issues that might cause the errors you're encountering, such as the "Too much large header 400 error" and issues with the environment settings. Here are some steps to help resolve these:

1. Adjust IIS Request Limits

• The "Too much large header 400 error" often occurs because the default IIS settings might limit the size of headers. Azure Entra ID tokens can be large, especially when the application uses multiple claims.
• To adjust these limits:
  1. Open the IIS Manager.
  2. Select your site and go to the "Request Filtering" module.
  3. Under the "Request Limits" tab, increase the MaxAllowedContentLength and MaxQueryString values.
  4. You may also need to edit your web.config file directly to increase the maxAllowedContentLength in the <requestLimits> section:

<system.webServer>
  <security>
    <requestFiltering>
      <requestLimits maxAllowedContentLength="30000000" />
    </requestFiltering>
  </security>
</system.webServer>

Answer 2

your authentication cookie is too large (over 12k). Either limit the number of claims, or configure IIS to support larger headers.

https://github.com/MicrosoftDocs/iis-docs/blob/main/iis/configuration/system.webServer/security/requestFiltering/requestLimits/headerLimits/index.md

note: proxies and firewalls can also limit header size, so it’s best to fix the underlying problem.