Athorization stopped saving and started asking consent on localhost

Get Help
,
3

Hi @yaroslavtereshchuk

Welcome back to the Auth0 Community!

I understand that you are experiencing repeated login prompts and consent screens on your Auth0-integrated application running on localhost after a recent browser update.

The issue is caused by third-party cookie blocking in your browser, which breaks Auth0’s silent session restoration mechanism. On localhost specifically, Auth0 enforces a security rule that prevents silent consent skipping, forcing a full interactive login on every page reload.

Root Cause: Your browser’s tracking protection or third-party cookie blocking feature was recently enabled (likely through an automatic update), preventing Auth0 from using hidden iframes to silently restore your session.

Solution: Implement Refresh Token Rotation, the modern best practice that eliminates reliance on third-party cookies entirely.

  1. Sign in to your Auth0 Dashboard and navigate to your Application settings.

  2. Enable Refresh Token Rotation in your application configuration.

  3. Update your SPA codebase configuration. If you are using @auth0/auth0-react or @auth0/auth0-spa-js, add the following to your Auth0Provider or Client initialization:

useRefreshTokens: true,
cacheLocation: 'localstorage'
  1. Verify that the SDK now saves the rotating refresh token in your browser’s local storage, allowing sessions to persist across page reloads without third-party cookies.

Official Workaround (temporary): If you need an immediate fix before implementing Refresh Token Rotation, you can temporarily disable third-party cookie blocking in your browser. In Chrome, navigate to chrome://settings/trackingProtection or chrome://settings/cookies and either disable tracking protection or add [*.]auth0.com to the allowlist for third-party cookies. Note that this is a temporary measure; third-party cookies are being phased out across all browsers.

Additional note: If you implement Refresh Token Rotation but still see the consent screen on your first local login, consider moving your development environment away from localhost, as Auth0 applies stricter security rules to localhost applications.

Please follow up if you need further assistance with Refresh Token Rotation configuration.

Kind Regards,
Nik