Let me explain, when I log out I left the login page there for a while without close the tab. I come back again to the login page without refresh and when I try to login it shows an error page.
The error shows: “access_denied: Password login via OIDC-conformant clients with externally-hosted login pages is unsupported. Alternatively, login could have been initiated from the wrong place.”
I tested 3 applications, is this an expected behavior of auth0 system?
Yes, the Auth0 login page will throw this error if the page is left open for more than 30 minutes. This same error can also occur in the following situations:
If you access the login page from a bookmark.
If you attempt concurrent authentication flows in the same browser session.
If there are multiple submissions of the authentication form by the end-user from a single login page.
In other cases where the browser fails to send the correct cookies necessary for login.