auth0auth0-lock

Auth0 Authorization Code Flow with custom login page


Is it possible to use Auth0 Authorization Code Flow without Auth0 lock (widget)?

Auth0 /authorize endpoint always redirects to auth0 lock, can it redirect to custom login page?


Solution

  • Short Answer: Auth0 is not suitable for custom login page.

    Long Answer: The only solution provided by Auth0 is embedded login for web, but it has security issues and hard to setup. Quoting from their website:

    There are security concerns with this approach, particularly if you do not use the Custom Domains feature at Auth0, as this potentially opens your application up to cross-origin authentication issues.

    In fact, Chrome is going to disable cross-origin authentication attempts in the future: https://www.chromium.org/Home/chromium-security/extension-content-script-fetches/

    Quoting Again from Chromium‎ > ‎Chromium Security‎ > ‎ Changes to Cross-Origin Requests in Chrome Extension Content Scripts

    tl;dr: To improve security, cross-origin fetches will soon be disallowed from content scripts in Chrome Extensions. Such requests can be made from extension background pages instead, and relayed to content scripts when needed.