Auth0 console says email is verified, but auth0 user in app says email_verified = false

[accountsjs.com]

Has anyone ran into this before?

Edit: if I logout and login, my email is verified.

So maybe some kind of caching issue

Endpoint /tokeninfo returns stale email_verified value

I think this is more like an issue than a question. Here are the steps to reproduce the issue: Login with email/password to get id_token Call endpoint /tokeninfo to get user information. The result will look fine. Change the email of the user, so a verification email is sent out. Click the link in verification email to verify the email change. Call endpoint /tokeninfo again. The problem is that email_verified is false, although it shows email verified in Auth0 dashboard.

[Ale]

Hi Anthony,

Welcome to the Auth0 Community

How are you checking that email_verified is true or false on your application?

I’m wondering if the problem here is that you are looking at the id_token that you grabbed when you logged into your application. That would explain why the email_verified value is not updated and why it gets updated after a log out and log in process.

Have you tried calling /userinfo from your application after verifying the user’s account?

[accountsjs.com]

@Ale

We attach the accessToken to our HTTP request (graphql) and then the backend uses that to get the user info

We use the @auth0/nextjs-auth0 “getSession” function to get the access token

I would think every new HTTP request should grab the latest session. So either auth0 isn’t giving us the latest session, or there is some kind of cloudflare caching issue?

This sounds pretty similar to the issue I’m having

Check if email_verified without signing in again.

I’m currently using the v8 version of auth0.js I’m successfully able to find out if the user’s email is verified with this call function getUserInfo() { var deferred = $q.defer(); accessToken = localStorage.getItem('accessToken'); webAuth.client.userInfo(accessToken, function(err, userInfo) { if (err) { deferred.reject('Can not get user info'); } else { userInfo = userInfo; deferred.resolve(userInfo); } }); With this inf…

and here

Calling user info endpoint returns stale information for email verified attribute

I’m using Auth0.js to call signupAndAuthorize, effectively storing an access_token in localStorage and calling the HTTP API directly (not through Auth0.js) at /userinfo to get the email_verified value for the user. I keep doing that every time the app starts. When I tried verifying the email though, I see it as true on the Raw JSON part of the Dashboard, but the calls to /userinfo keep returning email_verified=false! This happens until I login again, then I get it as true. Why?

I guess we need to integrate with the management api and rely on that instead of using the decoded token?

[Ale]

@accountsjs.com you might be correct in your hypothesis:

@accountsjs.com

I would think every new HTTP request should grab the latest session. So either auth0 isn’t giving us the latest session, or there is some kind of cloudflare caching issue?

I didn’t have the time to test this but after taking a look at https://github.com/auth0/nextjs-auth0/blob/main/V1_MIGRATION_GUIDE.md#getsession and also session/get-session | @auth0/nextjs-auth0 I think that there might be a problem with the getSession function you are using. It uses a cache system that might not be updating correctly.

The nextjs-auth0 SDK has been developed very recently so there’s the possibility of bugs like this one. Actually, I found a potentially related and reported bug: Refetch additional user informations from the backend · Issue #316 · auth0/nextjs-auth0 · GitHub

I encourage you to report this directly on the repo: Issues · auth0/nextjs-auth0 · GitHub

You could work around this issue by calling our https://auth0.com/docs/api/authentication#get-user-info directly (preferred method since you should already have an Access Token if I understood correctly) or via our Auth0 Management API v2

Let me know if all this makes any sense.

[accountsjs.com]

Thanks for taking time to research this.

[accountsjs.com]

Found this as well

https://github.com/auth0/nextjs-auth0/issues/23