B2C Custom policy preventing loading and rendering custom html file

Hello @Tuan Pham Van,

Prioritize these steps:

1.  Reduce login.html to the absolute bare minimum (static text only) to confirm the rendering pipeline itself is functional.
2.  If external scripts are necessary, they are the primary suspect. Ensure the domains they load from are accessible from the failing geographic locations.
3.  Ensure Azure Blob Storage CORS rules explicitly allow requests from the Azure B2C identity provider domain.

Step 1: Verify Content Host Configuration (Azure Blob Storage)

Ensure that your Blob Storage container has the correct Cross-Origin Resource Sharing (CORS) settings configured to allow requests from the Azure AD B2C domain. Allowed Origins should include B2C domains like https://login.microsoftonline.com or https://<your_tenant_name>.b2clogin.com. Allowed Methods should include GET. Also, verify the container/blob access level is set correctly (Blob or Container level set to Anonymous read access for blobs).

Step 2: Validate HTML Structure and Script Execution

Temporarily remove all external tags and all inline `<script>...</script>` blocks. Replace them with static HTML (e.g., a simple `Hello World`). If the static HTML loads successfully, the problem lies in one of your scripts. If you must use inline scripts, ensure they are strictly placed at the end of the. Review all JavaScript for common errors that cause immediate parsing failure.

If the Answer is helpful, please click Accept Answer and Up-Vote, so that it can help others in the community looking for help on similar topics.

If you still have questions, please let us know what is needed in the comments so the question can be answered.

Hi SUNOJ KUMAR YELURU
Thank for the answer

Regarding your answer:

We cannot remove the script; it is really necessary for our HTML page.

You said: “Ensure the domains they load from are accessible from the failing geographic locations.”

I understand this to mean that internet policies might be blocking the file or domain.

However, sometimes at the same location, the same user can log in normally, but other times encounters the error.

I don’t think the B2C domain is blocking it, which aligns with the login behavior explanation for the same user mentioned above.

"Cross-Origin Resource Sharing" does not seem to be the cause.

We have already enabled CORS.

If it were a CORS issue, other users would be consistently affected, which is not the case.

The last point, “Validate HTML Structure and Script Execution”, makes me confused.

• Do you mean that if the HTML parsing fails, or if the script throws an error during execution, it could completely block the page from rendering?Regarding your answer: We cannot remove the script; it is really necessary for our HTML page. You said: “Ensure the domains they load from are accessible from the failing geographic locations.”
  • I understand this to mean that internet policies might be blocking the file or domain.
  • However, sometimes at the same location, the same user can log in normally, but other times encounters the error.
  • I don’t think the B2C domain is blocking it, which aligns with the login behavior explanation for the same user mentioned above.
  "Cross-Origin Resource Sharing" does not seem to be the cause.
  • We have already enabled CORS.
  • If it were a CORS issue, other users would be consistently affected, which is not the case.
  The last point, “Validate HTML Structure and Script Execution”, makes me confused.
  • Do you mean that if the HTML parsing fails, or if the script throws an error during execution, it could completely block the page from rendering?

Hello Tuan Pham Van,

Your custom HTML page loads external or inline scripts, and in certain regions, Azure AD B2C blocks the page when any script fails to load, resulting in the error.

To fix the issue check the below:

• Use a single Azure Blob container to host ALL JS and CSS files (no external CDNs).
• All inline scripts should be removed and moved to a different.js file.
• Make sure the Blob container is accessible to everyone (anonymous read).
• Select the appropriate MIME types: .html → text/html .js → application/javascript
• Use the B2C UI test tool at https://jwt.ms/#b2cuitest to test the file. When all scripts load cleanly, the B2C page renders successfully in all areas.