Our security team flagged a medium severity security concern with Auth0 login, during a penetration test on an app secured with Auth0. The concern is that the Auth0 login pages do not have Content Security Policy (CSP) setup, to defend against XSS injection. Please will you consider setting up Conte…

Security team asked if you can submit your concern to our responsible disclosure program here: [image] Auth0: Secure access for everyone. But not just anyone. Rapidly integrate authentication and authorization for web, mobile, and legacy applications so you can focus on your core busin…

Content Security Policy

Get Help

konrad.sopala August 14, 2019, 2:47pm 7

Our security team is reviewing your request. As soon as I have info from them, I’ll get back to you!

Topic		Replies	Views
Clickjacking via iframes Get Help security	5	4551	August 29, 2019
Security of universal login Get Help auth0	2	1795	March 10, 2022
CSP errors in Electron app Get Help security-question-concern , security-compliance	3	80	December 6, 2024
Clickjacking Protection in Classic Universal Login! Announcements auth0 , login , universal-login , click-jacking	2	8600	September 3, 2019
Login Page error - ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'" Get Help auth0 , login	0	3308	June 11, 2021

Content Security Policy

Related topics