Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
Hi Habiba Asif,
Your Next.js app is running on Azure App Service with Easy Auth (Microsoft Entra authentication) enabled. This is blocking your app’s API call to https://dev-empiric.azurewebsites.net/api/auth/session because the request isn’t authenticated.
The error UntrustedHost: Host must be trusted means your app doesn't trust the Azure domain yet. You'll need to update your app’s authentication settings to recognize the Azure domain as a trusted host.
Your app worked before because Easy Auth wasn't turned on. Once you enabled Microsoft Entra authentication, it started blocking all requests—including those to your NextAuth.js API routes—causing the current authentication issue.
Option 1: Allow NextAuth.js to manage authentication
1). Disable Azure Authentication (Easy Auth):
- Go to your App Service → Authentication
- Turn off
App Service Authentication
2). Update your NextAuth config to trust the Azure domain
// pages/api/auth/[...nextauth].js or app/api/auth/[...nextauth]/route.js
import NextAuth from 'next-auth'
export const authOptions = {
// your existing config and providers
trustHost: true,
trustedHosts: [
'https://dev-empiric.azurewebsites.net',
'http://localhost:3000'
]
};
export default NextAuth(authOptions);
3). Set environment variables in Azure App Service -> Configuration
NEXTAUTH_URL=https://dev-empiric.azurewebsites.net
NEXTAUTH_URL_INTERNAL=https://dev-empiric.azurewebsites.net
NEXTAUTH_SECRET=your-secret-key
4). Redeploy and Restart the App
Option 2: Keep Azure Authentication enabled
If you need Azure Easy Auth (e.g., for corporate sign-in), you’ll need to configure it so it doesn’t block your API endpoints:
- Go to App Service -> Authentication
- Set
Unauthenticated requeststoAllow anonymous requests - Let your app handle login at
/api/auth/signinusingNextAuth.js
Please see the documents below for your reference.
Azure App Service - Overview of Authentication/Authorization