Custom Action: user stays logged into Auth0 after api.access.deny

[tyf]

Hey there @mcantrell !

@mcantrell

Is there a way to prevent the login so this condition doesn’t occur?

As api.access.deny does not end any existing session, you’ll also want to log users out in order to avoid the loop you’re experiencing. Please see the following post:

How to handle access denied response

Hi @gabor.ottlik.hun, When you use the api.access.deny() method, it will deny users from logging in, but their session will remain intact. So, in subsequent login attempts, the user will continuously be sent to the error page (http://localhost:3000/api/auth/callback?error=access_denied&error_description=access%20denied.&state=eyJyZXR1cm5UbyI6Imh0dHA6Ly9sb2NhbGhvc3Q6MzAwMCJ9) until the user logs out. That said, you will need to log the user out whenever they have been denied access to kill the …