Our security team flagged a medium severity security concern with Auth0 login, during a penetration test on an app secured with Auth0. The concern is that the Auth0 login pages do not have Content Security Policy (CSP) setup, to defend against XSS injection. Please will you consider setting up Conte…

Security team asked if you can submit your concern to our responsible disclosure program here: [image] Auth0: Secure access for everyone. But not just anyone. Rapidly integrate authentication and authorization for web, mobile, and legacy applications so you can focus on your core busin…

Content Security Policy

Get Help

Topic		Replies	Views
Clickjacking via iframes Get Help security	5	4557	August 29, 2019
Security of universal login Get Help auth0	2	1795	March 10, 2022
CSP errors in Electron app Get Help security-question-concern , security-compliance	3	90	December 6, 2024
Clickjacking Protection in Classic Universal Login! Announcements auth0 , login , universal-login , click-jacking	2	8621	September 3, 2019
Login Page error - ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'" Get Help auth0 , login	0	3313	June 11, 2021

Content Security Policy

Related topics