401 How to configure the simultaneous operation of the site by domain name and IP address in blazor wasm + identityserver?

Question

We launch the site, go to the ip address, log in and everything works. If you then go to this site using the domain name, the authorization works, but an error occurs when sending get / post requests to the server: "Failed to load resource: the server responded with a status of 401 (unauthorized)"

Please note that authorization in both cases is successful. The error occurs when the HttpClient sends a request.

The same problem occurs if the server has several network interfaces with different networks (for example, local and work). The site will work correctly only for one network.

The project was created based on a standard template: Blazor WebAssembly App (Core hosted) and Identity server. enter image description here

Configuring Kestrel in a file appsettings.json

{
  ...
  "IdentityServer": {
    "Clients": {
      "BlazorAppCore5.Client": {
        "Profile": "IdentityServerSPA"
      }
    },
    "Key": {
      "Type": "Development"
    }
  },
  "Kestrel": {
    "Endpoints": {
      "Http": {
        "Url": "https://*:5001"
      }
    }
  },
  "AllowedHosts": "*"
}

We publish the project and run.

enter image description here

We go to the site by computer name and log in: "https://desktop-9thm5hg:5001/"

enter image description here

Works! And now we go to 127.0.0.1 or localhost: "https://127.0.0.1:5001/"

enter image description here

Authorization works, pages "Home" and "Counter" are working. They don't use the HttpClient.

Now go to page fetchdata.

enter image description here

Attention! If you restart the site and go to "https://127.0.0.1:5001/" for the first time, it will not work on "https://desktop-9thm5hg:5001/".

Checked on ASP.NET Core version 3.1, 5.0

Tore Nestenius Tore Nestenius · Accepted Answer · 2020-12-17T15:07:29

You should aim to have one domain name for your identityServer that is used by all clients and API's. Also its best practice to use HTTPS everywhere and for HTTPS you need certificates and a domain.

The issuer is also part of the tokens and the token validation will be problematic when the name of the issuer (Ip or domain changes)

401 How to configure the simultaneous operation of the site by domain name and IP address in blazor wasm + identityserver?

1 Answers