Enforce PKCE with Actions

Knowledge Articles
1

Overview

This article will provide a step-by-step guide on how to enforce Proof Key for Code Exchange (PKCE) using post-login actions.

Applies To

  • Proof Key for Code Exchange (PKCE)
  • Actions

Solution

  1. Navigate to https://manage.auth0.com/;
  2. On the Dashboard, click on Actions > Library
  3. On the top right corner, click on Create Action > Build From Scratch
  4. Choose the desired name, and the Trigger should be Login / Post Login
  5. Use the code snippet provided below and adjust it as required
  6. Deploy and add the action to the trigger
exports.onExecutePostLogin = async (event, api) => {

 const code_challenge = event.request.query.code_challenge;




 if (!code_challenge) {

  api.access.deny("You are not allowed to Login")

 }

};