# Failed Silent Auth: login required

**URL:** <https://community.auth0.com/t/failed-silent-auth-login-required/56752>\
**Category:** Get Help\
**Created:** [January 25, 2021, 3:24pm UTC](https://community.auth0.com/t/failed-silent-auth-login-required/56752 "2021-01-25T15:24:12Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![RJJ](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rjj/32/24112_2.png) [@RJJ](https://community.auth0.com/u/RJJ)\
**Post date:** [January 25, 2021, 3:24pm UTC](https://community.auth0.com/t/failed-silent-auth-login-required/56752/1 "2021-01-25T15:24:12Z")

</div>

Hi dear community:

When I use auth0/auth0-spa-js library for browser sign up and login flow. I found the following:

Right after user signup, it is redirecting to my home page and correctly asking user to login without going to the username/pwd screen. On a few browsers, the login failed and if user click login again, it does not show username/pwd entering screen at all, instead it just silently attempts to login in again which keeps failing. Basically, the new users are not able to login on a few browsers.

It works well on the following browsers as far as i see: 1. chrome (Mac) 2. firefox (Mac)

It doesn’t work on 1. Safari (Mac) 2. Chrome (Iphone) 3. Safari(Iphone)

I noticed from a few posts that there are few work-around:

1. disable browser prevent cross-site tracking (for Mac Safari) → it worked for me, but only solved one platform issue.
2. set rotate token = true, and use the following code to create auth0client:  
createAuth0Client({  
domain: xxx  
client\_id: xxx  
audience: xxx  
redirect\_uri: xxx  
useRefreshTokens: true  
})

according to this: **[Auth0 Single Page App SDK](https://auth0.com/docs/libraries/auth0-single-page-app-sdk)**  
 → however it didn’t work for me either. Please see the error listed above from mobile chrome workflow.

Question:

1. is there a way to force show login screen again so that login is not relying on cookie session info.
2. is there any configuration issue which caused the error even when I set rotate token=true?

Appreciate your help.  
XJ

{  
“date”: “2021-01-25T15:04:14.757Z”,  
“type”: “fsa”,  
“description”: “Login required”,  
“client\_id”: “”,  
“client\_name”: “”,  
“ip”: “217.169.19.14”,  
“user\_agent”: “Chrome Mobile iOS 87.0.4280 / iOS 14.3.0”,  
“details”: {  
“body”: {},  
“qs”: {  
“client\_id”: “”,  
“audience”: “”,  
“redirect\_uri”: “”,  
“scope”: “openid profile email offline\_access”,  
“response\_type”: “code”,  
“response\_mode”: “web\_message”,  
“state”: “xxx”,  
“nonce”: “xxx”,  
“code\_challenge”: “xxx”,  
“code\_challenge\_method”: “S256”,  
“prompt”: “none”,  
“auth0Client”: “xxx”  
},  
“connection”: null,  
“error”: {  
“message”: “Login required”,  
“oauthError”: “login\_required”,  
“type”: “oauth-authorization”  
},  
“riskAssessment”: null  
},  
“hostname”: “”,  
“audience”: “”,  
“scope”: [  
“openid”,  
“profile”,  
“email”,  
“offline\_access”  
],  
“auth0\_client”: {  
“name”: “auth0-spa-js”,  
“version”: “1.12.0”  
},  
“log\_id”: “90020210125150420610005775599721818011453075753948676130”,  
“\_id”: “90020210125150420610005775599721818011453075753948676130”,  
“isMobile”: true  
}

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [January 25, 2021, 8:36pm UTC](https://community.auth0.com/t/failed-silent-auth-login-required/56752/3 "2021-01-25T20:36:48Z")

</div>

Hi @RJJ,

Can you try using localstorage as your cache location?

`cacheLocation: 'localstorage'`

> **[Auth0 Single Page App SDK](https://auth0.com/docs/libraries/auth0-single-page-app-sdk#change-storage-options)**
>
> Auth0 SDK for single page applications using Authorization Code Grant Flow with PKCE.

---

<div class="post-metadata">

**Author:** ![RJJ](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rjj/32/24112_2.png) [@RJJ](https://community.auth0.com/u/RJJ)\
**Post date:** [January 25, 2021, 9:43pm UTC](https://community.auth0.com/t/failed-silent-auth-login-required/56752/4 "2021-01-25T21:43:57Z")

</div>

> [@dan.woda](#):
>
> Auth0 Single Page App SDK

Hi @dan.woda , thank you very much for the speedy reply.

I tried the setting metioned in the post. However, still seems to hit the issue in both Mac Safari and IOS Chrome.

Here is the code:  
this.webClient$ = (from(  
createAuth0Client({  
domain: ,  
client\_id: ,  
audience: ,  
redirect\_uri: `,  
cacheLocation: ‘localstorage’  
})

It seems the cacheLocation setting is not effective for some reason. Is there a way to confirm this setting is applied?

Thank you again.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [January 25, 2021, 10:04pm UTC](https://community.auth0.com/t/failed-silent-auth-login-required/56752/5 "2021-01-25T22:04:41Z")

</div>

Can you try both?

useRefreshTokens: true  
cacheLocation: ‘localstorage’

---

<div class="post-metadata">

**Author:** ![RJJ](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rjj/32/24112_2.png) [@RJJ](https://community.auth0.com/u/RJJ)\
**Post date:** [January 26, 2021, 1:30pm UTC](https://community.auth0.com/t/failed-silent-auth-login-required/56752/6 "2021-01-26T13:30:58Z")

</div>

> [@dan.woda](#):
>
> useRefreshTokens: true

hi @dan.woda , I tried both settings:  
createAuth0Client({  
domain:  
client\_id: ,  
audience: ,  
redirect\_uri:  
useRefreshTokens: true,  
cacheLocation: ‘localstorage’

But still hit the same problems as before.

Here are the events for signup-\> signin flow which I got from logs:  
Success Signup → Success Login → Failed Silent Auth

You can see initially we get successful login, but later on silent auth failed.  
And by the way, once I disable Mac Safari prevent cross-site tracking, I managed to login. So it still seems to me the localstorage setting is not applied, auth0 server is still relying on cookie which is blocked by browser.

Is it possible to help me investigate further?

Regards  
XJ

---

<div class="post-metadata">

**Author:** ![RJJ](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rjj/32/24112_2.png) [@RJJ](https://community.auth0.com/u/RJJ)\
**Post date:** [January 26, 2021, 1:51pm UTC](https://community.auth0.com/t/failed-silent-auth-login-required/56752/7 "2021-01-26T13:51:22Z")

</div>

@dan.woda

update: it works fine now after I upgrade @auth0/auth0-spa-js from 1.12.0 version to the latest. 1.13.6. Tested the work flow in Mac Safari and Mobile chrome browser with success.

Can I understand the consequence of setting cacheLocation: ‘localstorage’? And is it a recommended way ?

Regards  
XJ

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [January 26, 2021, 9:22pm UTC](https://community.auth0.com/t/failed-silent-auth-login-required/56752/8 "2021-01-26T21:22:09Z")

</div>

Hi @RJJ,

Great, I will mark this as resolved. The issue was an outdated SDK.

As for the consequences of using localstorage as the cache, I will repeat this warning from out docs:

> Storing tokens in browser local storage provides persistence across page refreshes and browser tabs. However, if an attacker can achieve running JavaScript in the SPA using a cross-site scripting (XSS) attack, they can retrieve the tokens stored in local storage. A vulnerability leading to a successful XSS attack can be either in the SPA source code or in any third-party JavaScript code (such as bootstrap, jQuery, or Google Analytics) included in the SPA.

[https://auth0.com/docs/libraries/auth0-single-page-app-sdk#change-storage-options](https://auth0.com/docs/libraries/auth0-single-page-app-sdk#change-storage-options)

You can try just using refresh token rotation without the localstorage cache and see if that solves you problem.

---

<div class="post-metadata">

**Author:** ![RJJ](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rjj/32/24112_2.png) [@RJJ](https://community.auth0.com/u/RJJ)\
**Post date:** [February 1, 2021, 1:57pm UTC](https://community.auth0.com/t/failed-silent-auth-login-required/56752/10 "2021-02-01T13:57:19Z")

</div>

Hi @dan.woda

Very strangely, the working settings and library stopped working today again on Mac Safari and IOS Chrome.

The setting I used:  
“@auth0/auth0-spa-js”: “^1.13.6”

API createAuth0Client(  
useRefreshTokens: true,  
cacheLocation: ‘localstorage’  
)

Very puzzled why it stopped working. Is there a way to investigate further?

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [February 1, 2021, 8:31pm UTC](https://community.auth0.com/t/failed-silent-auth-login-required/56752/11 "2021-02-01T20:31:42Z")

</div>

Can you give more detail? Errors? logs?

---

<div class="post-metadata">

**Author:** ![RJJ](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rjj/32/24112_2.png) [@RJJ](https://community.auth0.com/u/RJJ)\
**Post date:** [February 1, 2021, 9:16pm UTC](https://community.auth0.com/t/failed-silent-auth-login-required/56752/12 "2021-02-01T21:16:10Z")

</div>

Sure. It is basically the same error as before.

{  
“date”: “2021-02-01T15:22:45.332Z”,  
“type”: “fsa”,  
“description”: “Login required”,  
“client\_id”: “”,  
“client\_name”: “”,  
“ip”: “”,  
“user\_agent”: “Chrome Mobile iOS 87.0.4280 / iOS 14.3.0”,  
“details”: {  
“body”: {},  
“qs”: {  
“client\_id”: “”,  
“audience”: “”,  
“redirect\_uri”: “”,  
“scope”: “openid profile email offline\_access”,  
“response\_type”: “code”,  
“response\_mode”: “web\_message”,  
“state”: “”,  
“nonce”: "S,  
“code\_challenge”: “”,  
“code\_challenge\_method”: “S256”,  
“prompt”: “none”,  
“auth0Client”: “”  
},  
“connection”: null,  
“error”: {  
“message”: “Login required”,  
“oauthError”: “login\_required”,  
“type”: “oauth-authorization”  
},  
“riskAssessment”: null  
},  
“hostname”: “”,  
“audience”: “”,  
“scope”: [  
“openid”,  
“profile”,  
“email”,  
“offline\_access”  
],

It seems to me the same error as before, but suddenly the fix was broken again.

Appreciate your guidance. thank you!

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [February 2, 2021, 5:41pm UTC](https://community.auth0.com/t/failed-silent-auth-login-required/56752/13 "2021-02-02T17:41:01Z")

</div>

Did anything change that would break it? Also, can you DM me a HAR?

> **[Generate and Analyze HAR Files](https://auth0.com/docs/troubleshoot/troubleshooting-tools/generate-and-analyze-har-files)**
>
> Learn how to troubleshoot with HAR files and steps to generate a HAR file.

---

<div class="post-metadata">

**Author:** ![viraj](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/viraj/32/27278_2.png) [@viraj](https://community.auth0.com/u/viraj)\
**Post date:** [February 8, 2021, 10:00pm UTC](https://community.auth0.com/t/failed-silent-auth-login-required/56752/14 "2021-02-08T22:00:37Z")

</div>

This broke for me on Firefox 85.0 + MacOS 10.15 too – it’s working on Chrome + MacOS 10.15 though. The error manifests as the user not remaining logged in, and needing to re-auth in each new session/tab.

---

<div class="post-metadata">

**Author:** ![RJJ](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rjj/32/24112_2.png) [@RJJ](https://community.auth0.com/u/RJJ)\
**Post date:** [February 9, 2021, 1:40pm UTC](https://community.auth0.com/t/failed-silent-auth-login-required/56752/15 "2021-02-09T13:40:04Z")

</div>

Hello! thanks for commenting on this.

However, even I force to try login again by calling loginRedirect(), it still keep coming back with the same error. loginWithPopup() works better although the popup window is not ideal.

Have you managed to re-auth correctly?

thanks!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [February 24, 2021, 1:40pm UTC](https://community.auth0.com/t/failed-silent-auth-login-required/56752/16 "2021-02-24T13:40:48Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.