?iss= after logout causes login form to re-render instead of completing login — only with Custom Domain, resolves after some time

Get Help
,
1

Setup

  • Angular SPA, auth0-spa-js v1.13.6, New Universal Login

  • Custom domain with OIDC proxy behind it

  • initiate_login_uri set to <APP_URL>/login

The problem

After logout + re-login immediately:

  1. User submits credentials on the Auth0 login form

  2. Instead of redirecting back to the app with ?code=&state=, the browser receives:

    <APP_URL>/?iss=https://<CUSTOM_DOMAIN>/

  3. Angular app loads, LoginComponent fires loginWithRedirect() again

  4. The Auth0 login form re-renders — user has to log in a second time

  5. On the second attempt it usually succeeds and lands on /policies

However — if the user waits a few minutes after logout and then tries to login, the issue does not occur. Login completes in one attempt as expected.

This never happens with the standard tenant domain (xxx.eu.auth0.com) regardless of timing.

What we have tried — none fully resolved it

  • Removed / blanked initiate_login_uri → no effect

  • prompt: 'login' + max_age: 0 on loginWithRedirect() → reduces frequency, not eliminated

  • federated: true on logout() → helps but issue still occurs immediately after logout

  • Passing iss back in subsequent loginWithRedirect() → intermittent improvement

  • Clearing browser cookies for custom domain → fixes it temporarily

Key observations

  • Issue is timing dependent — happens immediately after logout, not after a wait. Suggests a stale session or token in the OIDC proxy that takes time to expire/clear

  • ?iss= lands on app root (/?iss=), not /login?iss= — suggests the OIDC proxy behind the custom domain generates it, not Auth0’s initiate_login_uri

  • prompt=login does not suppress the ?iss= redirect — proxy appears to ignore it

  • Opening the login URL in a second browser window during an active login reliably triggers the issue

Questions

  1. Is the ?iss= redirect caused by a stale session in the OIDC proxy not yet cleared after federated: true logout?

  2. Why does this only happen with the custom domain and not the standard tenant domain?

  3. Is the OIDC proxy behind the custom domain responsible for generating ?iss=, not Auth0 itself?

  4. Is there a way to force the proxy session to clear immediately on logout rather than waiting for natural expiry?

  5. Does upgrading to auth0-spa-js v2.x resolve this?