Hi everyone, I’m using the latest version of lock (11.9.0) and I have some concerns about the security of redirect mode. During login in redirect mode the access token is passed to the redirect URL and is visible for a second in the browser address bar and it also appears in the browser history. My…

Concerns about access token in URL and browser history

nh43de September 11, 2018, 5:16pm 2

Any updates to this?

Not getting a refresh token from Auth0.authorize() - PKCE

Topic		Replies	Views
Access token is missing after redirect Help lock , access-token , hash , redirect	3	4792	March 2, 2018
Lock not redirecting, just keeps spinning after login Help lock	6	4335	October 6, 2018
Is the presence of the id_token in the URL a security risk? Help	3	2040	January 20, 2022
Lock 11 for web is removing URL Parameters Help lock , webauth	2	3726	December 17, 2018
Attempting to migrate from lock v9 to v11 -- problems(?) with rememberLastLogin Help lock , oidc-conformant , embedded-lock , last-login	2	4089	December 14, 2018