# Guardian MFA, Custom domains and blocking 3. party cookies

**URL:** <https://community.auth0.com/t/guardian-mfa-custom-domains-and-blocking-3-party-cookies/16349>\
**Category:** Get Help\
**Tags:** guardian, custom-domain, mfa\
**Created:** [October 5, 2018, 1:42am UTC](https://community.auth0.com/t/guardian-mfa-custom-domains-and-blocking-3-party-cookies/16349 "2018-10-05T01:42:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thornton](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@Thornton](https://community.auth0.com/u/Thornton)\
**Post date:** [October 5, 2018, 1:42am UTC](https://community.auth0.com/t/guardian-mfa-custom-domains-and-blocking-3-party-cookies/16349/1 "2018-10-05T01:42:48Z")

</div>

Maybe its me who can’t find the documentation or the setting, but i can’t get Guardian MFA,custom domains and blocking 3 party cookies to work.

Blocking 3. party cookies is required - we can’t ask our users to allow 3. party cookies and we can’t ask them not to use MFA.

So with that said here is the problem:

When enabling a custom domain, the login happens on [login.ourdomain.com](http://login.ourdomain.com) - all good so far.  
But the mfa-widget-1.5.js apparently connects to [ourauth0domain.guardian.com](http://ourauth0domain.guardian.com) and something then sets a cookie there with the domain [ourauth0domain.guardian.com](http://ourauth0domain.guardian.com). This is obviously blocked because it is a third party cookie (originating from an root domain different from our login domain)

So did i miss a configuration, a section of the documentation that states, that MFA, custom domains and third party cookies are a show stopper or is the system just plain broken because no one considered this scenario?

Can anyone shed some light on the issue?

Edit: Ok, so after a little fiddeling i realized i can change this  
" mfaServerUrl: “{{ mfaServerUrl }}”,"  
to this "mfaServerUrl: “[https://logintest.ourdomain.com/guardian/](https://logintest.ourdomain.com/guardian/)” in the Guardian Multifactor hosted page.

So where in the documentation does it state that you have to do this to get custom domains, MFA an TPC to work?

---

<div class="post-metadata">

**Author:** ![danwarner](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/danwarner/32/10883_2.png) [@danwarner](https://community.auth0.com/u/danwarner)\
**Post date:** [January 14, 2019, 6:47pm UTC](https://community.auth0.com/t/guardian-mfa-custom-domains-and-blocking-3-party-cookies/16349/2 "2019-01-14T18:47:48Z")

</div>

Thanks Thornton this was helpful. It’s frustrating that we need to use a custom Guardian MFA hosted page to support custom domains in Auth0. Seems like a feature that should be supported by the hosted page without having to now maintain a custom MFA hosted page.

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [August 29, 2019, 9:18am UTC](https://community.auth0.com/t/guardian-mfa-custom-domains-and-blocking-3-party-cookies/16349/3 "2019-08-29T09:18:13Z")

</div>