Implementing Auth0 with Reverse Proxy in mTLS Environment: Universal Login vs Embedded Login Approaches

Get Help
,
1

Hello Auth0 Community,

I’m planning to implement Auth0 as an authentication system for our application with the following requirements:

System Architecture:

  • Application backend hosted on AWS
  • React client applications running on terminals within our on-premises network
  • Connection between on-premises and AWS via Direct Connect
  • mTLS is mandatory for all client-to-AWS communications
  • Authentication using username/password only (no external IdP integration yet)

Current Challenge: Since mTLS is only available in Auth0’s Enterprise plan (which we’re not using), I’ve set up the following workaround:

  1. Deployed a reverse proxy on AWS pointing to https://{AUTH0_DOMAIN}/
  2. All client-to-Auth0 traffic routes through https://auth.ourapp.com/ (resolved via Private Host Zone)
  3. Planning to implement login forms using Embedded Login

However, I’ve encountered these implementation issues:

Questions:

  1. Is it possible to use Universal Login with our reverse proxy setup?
  2. If implementing with Embedded Login, what’s the most secure approach?
  3. Are there better alternatives for using Auth0 in an mTLS environment that I haven’t considered?

Any guidance would be greatly appreciated.

Thank you!

3

Hi @chrg,

Welcome to the Auth0 Community!

Yes, this should be possible. You might find our Configure AWS CloudFront as Reverse Proxy documentation helpful.

In general, we recommend using the Universal Login. However, if you decide to use embedded login, you must configure your app for cross-origin resource sharing and should configure a custom domain.

Since it is inherently riskier to use embedded login, I recommend referring to our Centralized Universal Login vs. Embedded Login doc to learn more about the security risks involved with an embedded login implementation.

You’re on the right track with using Auth0 with reverse proxy in your mTLS environment. Since mTLS support is limited to Enterprise plans, you’re doing the next best thing.

I hope this helps!

Let me know if you have any follow-up questions.

Cheers,
Rueben