Deny User Access Based on Auth0 Form Input

Knowledge Articles
1

Overview

This article provides a method for denying user access based on form input. The solution outlines the use of a Post-Login Action to render a form and then deny access if the input does not meet the specified validation criteria.

Applies To

  • Auth0 Actions
  • Auth0 Forms
  • Post-Login trigger

Cause

This issue occurs because Auth0 Forms do not have a built-in function to deny user access. The primary purpose of Forms is to collect user input, and the access control logic must be implemented separately within a Post-Login Action.

Solution

The following steps explain how to deny user access using a Post-Login Action to validate the input submitted through a form:

  1. Render the form in the onExecutePostLogin function of an Auth0 Action. The login flow pauses at this step, waiting for user input.
  2. Implement the validation logic in the onContinuePostLogin function.
  3. Access the data from the form using event.prompt.fields.
  4. Use api.access.deny() to terminate the login if the validation criteria are not met.
  5. To prevent the form from being rendered on subsequent logins, use api.user.setAppMetadata() to set a flag after the form has been successfully submitted. Subsequent logins can then check for this flag and skip the form and validation logic.

The following is an example of an Action that implements this logic. This example renders a form and then denies access if the user’s role ID from the form input does not match the expected role ID.

exports.onExecutePostLogin = async (event, api) => {
  const FORM_ID = 'YOUR_FORM_ID';
  api.prompt.render(FORM_ID);
}

exports.onContinuePostLogin = async (event, api) => {
  const expectedRoleId = 'Expected_Role_ID'; 

  if (event.prompt && event.prompt.fields && event.prompt.fields.ROLE_ID !== expectedRoleId) {
    api.access.deny('Access denied: Unauthorized role.');
  }
}

Please Note: We strongly recommend testing any custom code thoroughly in a development environment before deploying it to production. The provided code is an example and might need adjustments to fit specific use-cases.

For additional information on how form data is passed to Actions, refer to the related references below.

Related References