Changing redirect URL to a POST rather than a GET with PII in the url

This is a duplicate of this ticket (with some more information) which did not have a resolution and was closed: Auth0 adding personally identifiable information to redirect URL
We are using the Auth0 hosted password reset page and after a successfult password reset the user is being redirected back to our sign-in page:

See: Dashboard -> Emails -> Templates -> Redirect To

The redirect url generated by Auth0 included PII (personally identifiable information) in the form of the users email and a message:

http://mydomain.com/users/sign_in?email=user@email.com&message=You%20can%20now%20login%20to%20the%20application%20with%20the%20new%20password.

This information ends up in Google Analytics and is a violation of the TOS:
https://support.google.com/analytics/answer/2795983?hl=en

It also just a bad idea to include a user’s email in a plain URL and a message which can be hijacked into making the user believe something else.

How can we prevent the redirect URL from containing the user’s email and message? Is there anyway to send these parmeters as part of a request body using the POST action rather than a GET. This is coming as part of an internal security audit from one of our clients

1 Like

Hello @sthakur,

Welcome to the Community. I would suggest submitting this to the feedback link as well:

1 Like

Hi @sthakur,

You can remove the email address from the URL by updating your email templates:

2 Likes

Hi @andy.carter,

Thanks for the response. I do have one follow-up question:

Do I have to PATCH this one time only for every Auth0 appliance that I have? Or will this need to be done everytime when the instance is restarted?

Thanks,
Sagar Thakur

Hi @andy.carter,

I tried using the API Explorer as well as Postman to PATCH the email template but i am getting the following response:

{
“statusCode”: 404,
“error”: “Not Found”,
“message”: “The template does not exist and cannot be updated.”,
“errorCode”: “inexistent_email_template”
}

Hi @sthakur,

You should just need to patch this once via the management API. With regards to the 404, please check you are using reset_email for the templateName parameter rather than password_reset or change_password, which are only present for legacy reasons.

1 Like

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.