Auth0 default Connection name

[luke1988]

Hi there,

db connection name must be saved in scripts and therefore is public readable accoriding to your doc

Can I rename default Username-Password-Authentication connection? Or, may be replaced?
Thanks

[mathiasconradt]

In case you’re just getting started with Auth0 and if your application is a SPA (Single Page Application), I suggest to look at the Auth0 SPA SDK instead of the (older) Auth0.js (which you linked above).

In regards to the connection. You can create any other database connection (i.e. in the Auth0 Dashboard) and use that instead. You can give it any name you like. Renaming a connection isn’t possible though.

[luke1988]

Thanks Mathias!

I had a look on SPA SDK, however there are missing features like SignUp. Besides, I already do use SPA SDK in Angular app for securing communication to backend API (works brilliant by the way)

How did big players implemented this? They have fully customized login & sign-up process. Server-side rendered UI with Auth0.js?

I would like to seamlessly switch DYI auth to Auth0 and I would like to keep current UI/UX so this is why I am making so much noise around.

[mathiasconradt]

Most customers use the Auth0 Universal Login Page (ULP), which comes with both login and signup option. In the authorization request, it’s also possible to make the Auth0 signup tab / signup page show up by default (instead of the login).

This is both possible with the Auth0.js and also with the SPA SDK.

webAuth.authorize({'mode': 'signUp'});

plus a change in the Auth0 login page itself, see this thread for details:

How to redirect user to hosted signup page?

To open the sign up page in Lock you can use the [initialScreen] (Lock Configuration Options) configuration option. To send values into the hosted login page, you can send a query string parameter. In your application you would send: webAuth.authorize({ mode: 'signUp' }); In the hosted login page, you’ll then just need to add the initialScreen attribute in the Auth0Lock initialization code as: var lock = new Auth0Lock(config.clientID, config.auth0Domain, { (...) initialScreen: config.ex…

We usually encourage customres to use a redirect flow over an embedded one, both for login and signup. The Pros and Cons are described on Centralized Universal Login vs. Embedded Login

[luke1988]

I have read links you sent and there was pointed out several times a security risk of Cross origin authentication when using embedded login.

This is still valid warning even using Custom domains and same top level domain?

For example app is hosted on app.MyApp.com and Auth0 is configured to auth.MyApp.com?

Thanks