# Implementing Auth0 with Reverse Proxy in mTLS Environment: Universal Login vs Embedded Login Approaches **URL:** \ **Category:** Dev to Dev Hub\ **Tags:** new-universal-login-experience, login-experience\ **Created:** [April 7, 2025, 1:05pm UTC](https://community.auth0.com/t/implementing-auth0-with-reverse-proxy-in-mtls-environment-universal-login-vs-embedded-login-approaches/185107 "2025-04-07T13:05:19Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![chrg](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/chrg/32/74096_2.png) [@chrg](https://community.auth0.com/u/chrg)\ **Post date:** [April 7, 2025, 1:05pm UTC](https://community.auth0.com/t/implementing-auth0-with-reverse-proxy-in-mtls-environment-universal-login-vs-embedded-login-approaches/185107/1 "2025-04-07T13:05:19Z")
Hello Auth0 Community, I’m planning to implement Auth0 as an authentication system for our application with the following requirements: **System Architecture:** - Application backend hosted on AWS - React client applications running on terminals within our on-premises network - Connection between on-premises and AWS via Direct Connect - mTLS is mandatory for all client-to-AWS communications - Authentication using username/password only (no external IdP integration yet) **Current Challenge:** Since mTLS is only available in Auth0’s Enterprise plan (which we’re not using), I’ve set up the following workaround: 1. Deployed a reverse proxy on AWS pointing to `https://{AUTH0_DOMAIN}/` 2. All client-to-Auth0 traffic routes through `https://auth.ourapp.com/` (resolved via Private Host Zone) 3. Planning to implement login forms using Embedded Login However, I’ve encountered these implementation issues: - auth0-spa-js only supports Universal Login - For auth0.js implementation, I’m unsure if PKCE with authorization code flow can be used with Embedded Login (Reference: [Customize login page when using Authentication API with PKCE - #10](https://community.auth0.com/t/customize-login-page-when-using-authentication-api-with-pkce/88171/10)) **Questions:** 1. Is it possible to use Universal Login with our reverse proxy setup? 2. If implementing with Embedded Login, what’s the most secure approach? 3. Are there better alternatives for using Auth0 in an mTLS environment that I haven’t considered? Any guidance would be greatly appreciated. Thank you! ---
**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\ **Post date:** [April 22, 2025, 5:07pm UTC](https://community.auth0.com/t/implementing-auth0-with-reverse-proxy-in-mtls-environment-universal-login-vs-embedded-login-approaches/185107/3 "2025-04-22T17:07:12Z")
Hi @chrg, Welcome to the Auth0 Community! > [@chrg](#): > > Is it possible to use Universal Login with our reverse proxy setup? Yes, this should be possible. You might find our Configure AWS CloudFront as Reverse Proxy documentation helpful. > [@chrg](#): > > If implementing with Embedded Login, what’s the most secure approach? In general, we recommend using the Universal Login. However, if you decide to use embedded login, you must configure your app for cross-origin resource sharing and should configure a custom domain. Since it is inherently riskier to use embedded login, I recommend referring to our [Centralized Universal Login vs. Embedded Login](https://auth0.com/docs/authenticate/login/universal-vs-embedded-login#security-risks) doc to learn more about the security risks involved with an embedded login implementation. > [@chrg](#): > > Are there better alternatives for using Auth0 in an mTLS environment that I haven’t considered? You’re on the right track with using Auth0 with reverse proxy in your mTLS environment. Since mTLS support is limited to Enterprise plans, you’re doing the next best thing. I hope this helps! Let me know if you have any follow-up questions. Cheers, Rueben ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [May 6, 2025, 5:07pm UTC](https://community.auth0.com/t/implementing-auth0-with-reverse-proxy-in-mtls-environment-universal-login-vs-embedded-login-approaches/185107/4 "2025-05-06T17:07:13Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed. ---
**Author:** ![remus.ivan](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/remus.ivan/32/68771_2.png) [@remus.ivan](https://community.auth0.com/u/remus.ivan)\ **Post date:** [September 5, 2025, 8:39pm UTC](https://community.auth0.com/t/implementing-auth0-with-reverse-proxy-in-mtls-environment-universal-login-vs-embedded-login-approaches/185107/5 "2025-09-05T20:39:30Z")