diff --git a/public/components/form.js b/public/components/form.js
index 35dd851a0..1e0f6e1c2 100644
--- a/public/components/form.js
+++ b/public/components/form.js
@@ -257,7 +257,7 @@ export function format(name) {
 };
 
 export function multicomplete(input, datalist) {
-    input = input.trim().replace(/,$/g, "");
+    input = (input || "").trim().replace(/,$/g, "");
     const current = input.split(",").map((val) => val.trim()).filter((t) => !!t);
     const diff = datalist.filter((x) => current.indexOf(x) === -1);
     return diff.map((candidate) => input.length === 0 ? candidate : `${input}, ${candidate}`);
diff --git a/public/pages/adminpage/ctrl_backend_component_authentication.js b/public/pages/adminpage/ctrl_backend_component_authentication.js
index 63a0b89c6..26e71efa5 100644
--- a/public/pages/adminpage/ctrl_backend_component_authentication.js
+++ b/public/pages/adminpage/ctrl_backend_component_authentication.js
@@ -75,7 +75,7 @@ export default async function(render) {
             rxjs.first(),
             rxjs.map((cfg) => ({
                 type: cfg?.middleware?.identity_provider?.type?.value,
-                params: JSON.parse(cfg?.middleware?.identity_provider?.params?.value),
+                params: JSON.parse(cfg?.middleware?.identity_provider?.params?.value || "{}"),
             })),
         )),
         rxjs.concatMap(async ([availableSpecs, idpState = {}]) => {
@@ -175,7 +175,7 @@ export default async function(render) {
                 rxjs.map((e) => e.target.value),
             ),
         )),
-        rxjs.map((value) => value.split(",").map((val) => val.trim()).filter((t) => !!t)),
+        rxjs.map((value) => value.split(",").map((val) => (val || "").trim()).filter((t) => !!t)),
         rxjs.mergeMap((inputBackends) => getBackendEnabled().pipe(
             rxjs.first(),
             rxjs.map((enabledBackends) => inputBackends
@@ -206,7 +206,7 @@ export default async function(render) {
         }),
         rxjs.mergeMap((spec) => getAdminConfig().pipe(
             rxjs.first(),
-            rxjs.map((cfg) => JSON.parse(cfg?.middleware?.attribute_mapping?.params?.value)),
+            rxjs.map((cfg) => JSON.parse(cfg?.middleware?.attribute_mapping?.params?.value || "{}")),
             rxjs.map((cfg) => {
                 // transform the form state from legacy format (= an object struct which was replicating the spec object)
                 // to the new format which leverage the dom (= or the input name attribute to be precise) to store the entire schema
diff --git a/public/pages/adminpage/ctrl_backend_state.js b/public/pages/adminpage/ctrl_backend_state.js
index 5a0ef4e79..bb3d5a243 100644
--- a/public/pages/adminpage/ctrl_backend_state.js
+++ b/public/pages/adminpage/ctrl_backend_state.js
@@ -84,7 +84,7 @@ export function getState() {
         rxjs.map((config) => { // middleware
             const authType = document
                   .querySelector(`[data-bind="authentication_middleware"] [is="box-item"].active`)
-                  .getAttribute("data-label");
+                  ?.getAttribute("data-label");
 
             const middleware = {
                 identity_provider: {},
diff --git a/public/pages/adminpage/ctrl_setup.js b/public/pages/adminpage/ctrl_setup.js
index a0cbd7e59..c52ef7c76 100644
--- a/public/pages/adminpage/ctrl_setup.js
+++ b/public/pages/adminpage/ctrl_setup.js
@@ -7,13 +7,14 @@ import bcrypt from "../../lib/vendor/bcrypt.js";
 import { CSS } from "../../helpers/loader.js";
 import modal from "../../components/modal.js";
 import { get as getConfig } from "../../model/config.js";
+import ctrlError from "../ctrl_error.js";
 
 import { get as getAdminConfig, save as saveConfig } from "./model_config.js";
-import ctrlError from "../ctrl_error.js";
 import WithShell from "./decorator_sidemenu.js";
 import { cssHideMenu } from "./animate.js";
 import { formObjToJSON$ } from "./helper_form.js";
 import { getDeps } from "./model_setup.js";
+import { authenticate$ } from "./model_admin_session.js";
 
 import "../../components/icon.js";
 
@@ -68,13 +69,16 @@ function componentStep1(render) {
         preventDefault(),
         rxjs.mapTo(["name", "loading"]), applyMutation(qs($page, "component-icon"), "setAttribute"),
         rxjs.map(() => qs($page, "input").value),
-        rxjs.combineLatestWith(getAdminConfig().pipe(rxjs.first())),
-        rxjs.map(([pwd, config]) => {
-            config["auth"]["admin"]["value"] = bcrypt.hashSync(pwd);
-            return config;
-        }),
-        reshapeConfigBeforeSave,
-        saveConfig(),
+        rxjs.mergeMap((pwd) => getAdminConfig().pipe(
+            rxjs.first(),
+            rxjs.map((config) => {
+                config["auth"]["admin"]["value"] = bcrypt.hashSync(pwd);
+                return config;
+            }),
+            reshapeConfigBeforeSave,
+            saveConfig(),
+            rxjs.mergeMap(() => authenticate$({ password: pwd })),
+        )),
         rxjs.tap(() => animate($page, { time: 200, keyframes: slideXOut(-30) })),
         rxjs.delay(200),
         rxjs.tap(() => stepper$.next(2))
diff --git a/server/ctrl/static.go b/server/ctrl/static.go
index 6b50aca46..79dde8b64 100644
--- a/server/ctrl/static.go
+++ b/server/ctrl/static.go
@@ -126,12 +126,11 @@ func LegacyServeFile(res http.ResponseWriter, req *http.Request, filePath string
 
 func ServeBackofficeHandler(ctx *App, res http.ResponseWriter, req *http.Request) {
 	url := req.URL.Path
-	if url != URL_SETUP && Config.Get("auth.admin").String() == "" {
-		http.Redirect(res, req, URL_SETUP, http.StatusTemporaryRedirect)
-		return
-	}
-
 	if filepath.Ext(filepath.Base(url)) == "" {
+		if url != URL_SETUP && Config.Get("auth.admin").String() == "" {
+			http.Redirect(res, req, URL_SETUP, http.StatusTemporaryRedirect)
+			return
+		}
 		ServeFile(res, req, WWWPublic, "index.backoffice.html")
 		return
 	}