Auth0-react SDK: GetAccessTokenSilently returns error "Login required" in private browser

[brandonjolly]

Hey all,

Hope you are doing good. I am working on the same method right now.
Currently, I’m working on react application where I have integrated auth0 login/signup, and also once users log in, they will select the organization and then will continue for the application.

Here are information about SDK I’m using:

• SDK name - “@auth0/auth0-react”
• SDK Version - “^1.9.0”
• react - “^17.0.2”

And I have declared the required config parameters in Auth0Provider,

{
domain: ‘DOMAIN’,
clientId: ‘CLIENT_ID’,
redirectUri: ‘LOCATION’,
audience: ‘IDENTIFIER_STRING_VALUE’,
cacheLocation: ‘localstorage’,
onRedirectCallback
}

Using this, I can allow use to login simply. but when they select any organization from the list, I will pass that organization id in getAccessTokenSilently method to get token silently for the organization.

await getAccessTokenSilently({
organization: ‘ORGANIZATION_ID’,
ignoreCache: true
});

Now issue is that it is working fine in chrome and firefox, but when I check with chrome incognito or safari, It is not working and keep returning an error “Login Required”.

Am I missing anything? Please help me with this. Thanks!

[tyf]

Hey there @brandonjolly!

@brandonjolly

Now issue is that it is working fine in chrome and firefox, but when I check with chrome incognito or safari, It is not working and keep returning an error “Login Required”.

That’s great to hear that everything is working outside of Incognito and Safari at least! i believe the issue you are seeing is related to the blocking of 3rd party cookies by both Chrome Incognito and Safari as outlined in our getAccessTokenSilently documentation:

Note: Getting an Access Token silently without using Refresh Tokens will not work in browsers that block third-party cookies, such as Safari and Brave.

Hope this helps to clarify for you!

[brandonjolly]

Hey @tyf

Thank you so much for your response. I have tried with useRefreshTokens=true and with this, it is working fine and returning a JWT token without any error, but we are missing the organization id in the token, although I have added organization in the getAccessTokenSilently method.

is there any other param I need to add there? Please guide me here. Thanks!

[tyf]

No problem, happy to help where I can!

@brandonjolly

I have tried with useRefreshTokens=true and with this, it is working fine and returning a JWT token without any error, but we are missing the organization id in the token, although I have added organization in the getAccessTokenSilently method.

Good to know everything is working fine regarding refresh tokens - That’s curious the org_id is not included in the ID token. Is it included prior to getAccessTokenSilently is called?

[brandonjolly]

Hey,

No, It isn’t been added before, because we don’t want specific organization login, login will be common. But after that, we will show the organization list in which the user will be part, and the user will select the organization.
And based on that we will fetch the new token which included the organization id so that can help us on the API side to identify the data.

[brandonjolly]

Hey @tyf

Mentioning you in case you have missed the above reply, please look into it. Thanks!

[tyf]

Hey @brandonjolly sorry just getting around to this!

Are you passing in the org_id on the silent auth attempt something like this?

User switch between Organization

It’s not in the docs yet, you just have to pass it, and the sdk will append it to the /authorize request. You have to make sure you do ignoreCache: true so it’s not returning the same access token. You have to make sure the application user is auth against enables organization (it’ll ask if it’s organization only or personal use or both), if your application does not enabled for organization, then when you pass in organization parameter it’ll return an error. Also, if you don’t pass in authoriz…

[tyf]

Sorry, looping back I see that is the case - I’m still trying to figure out why the org_id wouldn’t be included in that case

[tyf]

A couple ideas in terms of isolating the issue:

• Are you able to locate the org_id param in the /authorize request associated with the getAccessTokenSilently silently call?

• I’d be curious to know if the org_id is indeed included as a claim in the ID Token if you about this the standard route - That is, by having a user log in and specify the Organization they belong to when they log in. If you’re interested in doing this our React sample app might be the easiest route.

Let us know!