Hi there, I am using Auth0 for one of my SPA projects and use auth0 js library. While debugging I found that , when a request is made to Auth0 by calling LoginwithRedirect, I can see all the secret values like ClientID, Secret, domain etc as part of Request header , they are plain text values and n…

Hi @maulik.khandwala , [image] maulik.khandwala: I can see all the secret values like ClientID, Secret, domain etc as part of Request header Client ID and domain are not secrets. You should expect any user that is using your app to have access to client ID and domain. This is because of the m…

Auth0 ClientID visible in chrome dev tools request header

Get Help

system Closed September 15, 2020, 8:47pm 4

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Safe management of Auth0 information in source control Get Help api , spa	4	5167	August 28, 2019
Auth Code + PKCE. Secret VS No Secret? Get Help jwt , auth0 , pkce	5	4910	April 14, 2021
Are application keys (domain and cliendID) supposed to be kept secret? Get Help auth0	3	3262	March 30, 2020
Storing client secret in SPA Get Help security , client-secret	2	12448	August 30, 2019
What use is the client secret of an OIDC compliant SPA Get Help apis , application	2	9	May 14, 2025

Auth0 ClientID visible in chrome dev tools request header

Related topics