Cannot login immediately after custom signup with universal login using SPA sdk

[evan.gillogley]

I’ve looked at all the recent topics (see references) on this and they don’t seem to answer this question for SPA apps. I want to use universal login with React SDK but custom sign up via api with auto login after sign up.

The auth0-js sdk allows login but I cannot bridge that authentication state into my SPA application via the SDK due to the requirements in the sdk library. This is because of the code_challenge and nounce security implemented here. auth0-spa-js/src/Auth0Client.ts at 8653181d23ecea17729da203253d4fa4d17d8ef6 · auth0/auth0-spa-js · GitHub

Is it theoretically possible to get around this challenge by making prepareAuthorizeUrl public and mimicing the nounce + state with authenticating auth0-js and localStorage transactionManager?
Right now I can login automatically with auth0-js but I get an invalid state on handleRedirectCallback() in the spa sdk.

What solution would you recommend to get immediate login after signup?

References

Automatic login after creating Auth0 user

Understood. When this happens, and the email address has never been used before, our backend will create an account for them and log them in in the background How do you protect against spam? Anybody can just use any email address, the email address isn’t verified at this point, if I see it correctly. Also, unless there’s bot protection in place, somebody could create a few thousand comments/accounts this way. We want to use an implicit signup to automatically create an account and login t…

Question - auth0-spa-js vs auth0-js