Infinite redirect Universal Login

Get Help
,
1

We have an issue we have run across as we evaluate using Auth0 as our Auth solution and have not been able to pin it down. When we provision an org and an app. The login goes into an infinite redirect.

The solution is to toggle the JWT settings under the advanced settings. Simply toggling that once after creating a new org / app clears the issue.

Has anyone seen this and know of a solution?

3

Hi @wponder11

Welcome to the Auth0 Community!

This is definitely weird behaviour, thank you for sharing this!
There are multiple potential causes of this and it is very likely something minor, but things that are worth double-checking on your end:

  • ensure your SDK is up to date;
  • some changes were made to the application, but have not been saved. This way, it might start an infinite loop, but once you toggle the JWT settings, it forces a save and refreshes the settings, which in turn updates all data and makes the application work correctly;
  • Actions might contribute to this behaviour, try to disable all Actions and run the application to test if this could also be a cause;

If you happen to be referring to toggling on the OIDC Conformant settings specifically, I believe that our documentation Adopt OIDC-Conformant Authentication might hold the answer to the issue.

Let me know if this helped with resolving the issue! If it’s still ongoing, pleases let me know what SDK and version you’re using.

Have a great one!
Gerald

4

Hey Gerald - We have a couple actions that limit registration by domain.

We have one tenant. When we create a new Org they get a copy of the app with it. Things end up looking like the following.

comp.domain
comp1.domain
comp2.domain

First user is sent an invite for their specific org.

We create the org, deploy the app and test the frontend. The setting we have to toggle after we do this is to stop the login redirect is. We do not use OIDC. We use the

JWT Signature Algorithm
Specify the algorithm used to sign the JSON Web Token: HS256: JWT will be signed with your client secret. RS256: JWT will be signed with your private signing key and they can be verified using your public signing key (see Certificates - Signing Certificate section).