Invalidate sso cookies

[James.Morrison]

I wanted to follow up on this front @flle as two alternative solutions were brought up to me which doesn’t require us disabling the SSO flag on your tenants.

1. You could also leverage the /logout endpoint and or have the app clear the local_storage cookie relevant to your application. All /authorize requests could be passed with prompt=login. No local cookie after logout means no Auth0 session will be honored on the authentication server.
   Logout

2. Leverage a rule as previously mentioned by one of our engineers here:

@Carlos_Mostek

Rules run after authentication, so if you know which user is associated with which tenant, then you should be able to do something like this:

1. User goes to your page https://myapp.com/myTenant
2. https://myapp.com/myTenant redirects to /authorize?redirect_uri=https://myapp.com/myTenant/callback
3. User enters their credentials on the login page (or they are automatically authenticated using the SSO cookie)
4. Auth0 validates the credentials and executes rules
5. The rule checks whether the user is allowed access to https://myapp.com/myTenant/callback
6. if so, they proceed as normal
7. if not, the rule rejects them with an UnauthorizedError

NOTE: if you aren’t using a different callback per user, then either the callback can do the check, or you could pass a special scope to the /authorize page to define the tenant, such as tenant:myTenant

Both these solutions enable us to leave your SSO enabled just in case you want to use it at a later time vs disabling it all together. Please give this a look and let me know how you would like to proceed forward. Thank you.