# Access "extraParams" in the Guardian Multifactor HLP

**URL:** <https://community.auth0.com/t/access-extraparams-in-the-guardian-multifactor-hlp/17772>\
**Category:** Get Help\
**Tags:** hosted-login-page, guardian\
**Created:** [November 9, 2018, 6:23pm UTC](https://community.auth0.com/t/access-extraparams-in-the-guardian-multifactor-hlp/17772 "2018-11-09T18:23:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![alex7](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/alex7/32/8738_2.png) [@alex7](https://community.auth0.com/u/alex7)\
**Post date:** [November 9, 2018, 6:23pm UTC](https://community.auth0.com/t/access-extraparams-in-the-guardian-multifactor-hlp/17772/1 "2018-11-09T18:23:26Z")

</div>

Is it possible to access the query params that were passed to the login page when on the Guardian Multifactor  
hosted login page (HLP)? When on the initial login page these are in the query parameters and are parsed to `extraParams`. I would like to customize the UI of the Guardian Multifactor HLP based on certain query params.

---

<div class="post-metadata">

**Author:** ![nicolas\_sabena](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nicolas_sabena/32/6064_2.png) [@nicolas\_sabena](https://community.auth0.com/u/nicolas_sabena)\
**Post date:** [November 12, 2018, 3:52pm UTC](https://community.auth0.com/t/access-extraparams-in-the-guardian-multifactor-hlp/17772/2 "2018-11-12T15:52:40Z")

</div>

Hi @alex7. I’m afraid it’s not possible. The `extraParams` is a legacy thing from the past that is definitely not part of the OAuth2/OIDC protocol. Since the Guardian page never offered access to`extraParams`, I doubt it will ever be available unless a sound use case is presented.

May I ask, out of curiosity, what would you customize if those values were available from the Guardian page?

---

<div class="post-metadata">

**Author:** ![alex7](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/alex7/32/8738_2.png) [@alex7](https://community.auth0.com/u/alex7)\
**Post date:** [November 12, 2018, 4:01pm UTC](https://community.auth0.com/t/access-extraparams-in-the-guardian-multifactor-hlp/17772/3 "2018-11-12T16:01:11Z")

</div>

I thought the OAuth2/OIDC spec did allow additional query parameters passed to the authorization endpoint?

That being said, I am passing parameters to control the title / icon on the HLP. Right now I am able to do that for the HLP but since that info is lost when directing to the guardian page, I cannot customize the logo / title on that page. While `extraParams` might not be possible, is there anyway way to add info using the guardian rule that can be incorporated using the liquid syntax when generating the guardian page?

---

<div class="post-metadata">

**Author:** ![nicolas\_sabena](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nicolas_sabena/32/6064_2.png) [@nicolas\_sabena](https://community.auth0.com/u/nicolas_sabena)\
**Post date:** [November 13, 2018, 11:16am UTC](https://community.auth0.com/t/access-extraparams-in-the-guardian-multifactor-hlp/17772/4 "2018-11-13T11:16:01Z")

</div>

Hi again. It’s not possible to pass additional parameters to the Guardian page through the rule either.

Not trying to make a excuse, but the line of thinking is that the authorization server is a separated entity from the applications that request an authentication. Think of Google and its many applications: Gmail, Youtube, Chrome, Android and so on. When you log in, you always see the “Google sign in” experience, almost identical each time (i.e. not branded for each specific application). This helps the user understand that it’s the same Google identity that can be used to authenticate to multiple assets (even though you see “to continue to {application name}” in the bottom) and that the same Google session is shared across all applications that request it.

If you are protecting just one application with your Auth0 domain, it might make sense to tie the whole authentication experience to that single application (even though you will get an obvious disruption if you use an external identity provider like a social connection). But if your Auth0 domain serves as the identity provider for many applications, the idea is to convey a single image for the authentication subsystem and SSO between the applications using the same identity and session.

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [August 28, 2019, 11:21am UTC](https://community.auth0.com/t/access-extraparams-in-the-guardian-multifactor-hlp/17772/5 "2019-08-28T11:21:10Z")

</div>


