Anomaly Detected on custom login page

Help
, , , ,
1

I am trying to migrate a custom login page for the new OIDC conformant flow and
I am facing issues with the DB login.

I initialize webAuth the following way:
webAuth0 = new auth0.WebAuth({
domain: “hektor-test.eu.auth0.com”,
clientID: ,
audience: “https://hektor-test.eu.auth0.com/api/v2/”,
scope: “openid offline_access”,
responseType: “token id_token”
});

After this I have tried two approaches:

  1. Popup login

webAuth0.popup.loginWithCredentials({
connection: “Username-Password-Authentication”,
device: “webapp”,
responseType: “id_token token”,
state: “{“page”:“login”}”,
redirectUri: “http://localhost:8088/#/pub/login/”
username: ,
password:
})

After the popup closes, I got the following error:

code: “access_denied”,
description: Object
code: “access_denied”
description: “Invalid state”
name: “AnomalyDetected”
statusCode: 403

What am I doing wrong?

  1. Redirect login

webAuth0.redirect.loginWithCredentials({
connection: “Username-Password-Authentication”,
device: “webapp”,
responseType: “id_token token”,
state: “{“page”:“login”}”,
redirectUri: “http://localhost:8088/#/pub/login/”
username: ,
password:
})

With this i get the following error message:
Failed to load https://hektor-test.eu.auth0.com/usernamepassword/login: Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘http://localhost:8088’ is therefore not allowed access.

I think this is related to this aspect, right?

Any help appreciated!!

2

Finally we have found a working configuration for DB logins.

I think the main change here was to use the ‘https://hektor-test.eu.auth0.com/userinfo’ URL as audience instead of our real API identifier (ending with ‘/api/v2’).

Also, we had to set up a local domain in our hostfile like this:
127.0.0.1 my.local.domain

in order to avoid the consent request problem described here:

The working full setup for anyone who struggles with this:
webAuth0 = new auth0.WebAuth({
audience: “https://hektor-test.eu.auth0.com/userinfo”,
clientID: ,
domain: “hektor-test.eu.auth0.com”
nonce: ,
responseType: “token id_token”
scope: “openid offline_access”
})

Popup login:

webAuth0.popup.loginWithCredentials({
connection: “Username-Password-Authentication”,
responseType: “id_token token”,
state: “{“page”:“login”}”,
redirectUri: “http://my.local.domain:8088/#/pub/login/”,
scope: “offline_access openid”,
nonce: ,
device: ‘webapp’,
username: ,
password:
});

Works with auth0-js v9.2.2! :slight_smile: