# Login in production not working

**URL:** <https://community.auth0.com/t/login-in-production-not-working/39057>\
**Category:** Get Help\
**Tags:** nodejs, passport, auth0\
**Created:** [March 9, 2020, 12:36pm UTC](https://community.auth0.com/t/login-in-production-not-working/39057 "2020-03-09T12:36:25Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![ikemnomso](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ikemnomso/32/18610_2.png) [@ikemnomso](https://community.auth0.com/u/ikemnomso)\
**Post date:** [March 9, 2020, 12:36pm UTC](https://community.auth0.com/t/login-in-production-not-working/39057/1 "2020-03-09T12:36:25Z")

</div>

I’m trying to deploy my nodes app on Heroku. I can login in locally but on the deployed app, after clicking login it just loops back to the login page. My Auth0 log shows Successful login but the app doesn’t redirect to the index page

---

<div class="post-metadata">

**Author:** ![mathiasconradt](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mathiasconradt/32/12758_2.png) [@mathiasconradt](https://community.auth0.com/u/mathiasconradt)\
**Post date:** [March 9, 2020, 1:23pm UTC](https://community.auth0.com/t/login-in-production-not-working/39057/2 "2020-03-09T13:23:33Z")

</div>

Anything (errors) to see in the browser’s developer toolbar \> console? And I assume you’re running on https (not http).

---

<div class="post-metadata">

**Author:** ![ikemnomso](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ikemnomso/32/18610_2.png) [@ikemnomso](https://community.auth0.com/u/ikemnomso)\
**Post date:** [March 9, 2020, 1:55pm UTC](https://community.auth0.com/t/login-in-production-not-working/39057/3 "2020-03-09T13:55:37Z")

</div>

Yes i am running on https I resolved the issue by adding this

```
if( app.get("env") === "production" ) 
 {

	sess.cookie.secure = true;
	app.set("trust proxy", 1);
}

```

But now i have an issue logging out.  
This is the auth0 error detail:

> The “returnTo” querystring parameter “[https://lance-events.herokuapp.com:47648](https://lance-events.herokuapp.com:47648)” is not defined as a valid URL in “Allowed Logout URLs”.

---

<div class="post-metadata">

**Author:** ![mathiasconradt](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mathiasconradt/32/12758_2.png) [@mathiasconradt](https://community.auth0.com/u/mathiasconradt)\
**Post date:** [March 9, 2020, 6:18pm UTC](https://community.auth0.com/t/login-in-production-not-working/39057/4 "2020-03-09T18:18:39Z")

</div>

You need to configure the `Allowed Logout URLs` in your Application in the Auth0 Dashboard, setting it to `https://lance-events.herokuapp.com:47648/`

 ![Screenshot from 2020-03-09 19-19-07](https://global.discourse-cdn.com/auth0/original/3X/d/5/d5221a8d0b5c7657e9e07f3f473e3943b8df0eb8.png)

---

<div class="post-metadata">

**Author:** ![ikemnomso](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ikemnomso/32/18610_2.png) [@ikemnomso](https://community.auth0.com/u/ikemnomso)\
**Post date:** [March 9, 2020, 7:49pm UTC](https://community.auth0.com/t/login-in-production-not-working/39057/5 "2020-03-09T19:49:25Z")

</div>

That didn’t help. The number _47648_ keeps changing

---

<div class="post-metadata">

**Author:** ![mathiasconradt](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mathiasconradt/32/12758_2.png) [@mathiasconradt](https://community.auth0.com/u/mathiasconradt)\
**Post date:** [March 9, 2020, 7:57pm UTC](https://community.auth0.com/t/login-in-production-not-working/39057/6 "2020-03-09T19:57:21Z")

</div>

The “Allowed Logout URLs” field unfortunately (or from a security perspective: luckily) doesn’t allow wildcards for the port number. But surprised: are you saying that the port of your webapp frequently changes, and there’s no way to make it a fixed number, or even the proper default 443 port for https ?

In any case, it either needs to be a fixed URL on Heroku side, or you’d need to add a list of URLs with all possible port numbers (yes, can be in the hundreds or thousands) to the Allowed Logout URLs list; whatever space that text input field allows - though that’s really not my recommended approach.  
That’s the only way to configure this though.

---

<div class="post-metadata">

**Author:** ![t-1000-t](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/t-1000-t/32/42164_2.png) [@t-1000-t](https://community.auth0.com/u/t-1000-t)\
**Post date:** [December 25, 2022, 11:37pm UTC](https://community.auth0.com/t/login-in-production-not-working/39057/7 "2022-12-25T23:37:53Z")

</div>

Hello. How did you solve this issue?

---

<div class="post-metadata">

**Author:** ![lihua.zhang](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lihua.zhang/32/39683_2.png) [@lihua.zhang](https://community.auth0.com/u/lihua.zhang)\
**Post date:** [January 14, 2023, 1:14am UTC](https://community.auth0.com/t/login-in-production-not-working/39057/8 "2023-01-14T01:14:42Z")

</div>

[This](https://community.auth0.com/t/redirect-users-after-logout/89786) FAQ explains the cause and solution for the below error, so link it to this topic.

`invalid_request: The "returnTo" querystring parameter "[https://YOUR_URL"](https://YOUR_URL)" is not defined as a valid URL in "Allowed Logout URLs"`

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [January 28, 2023, 1:15am UTC](https://community.auth0.com/t/login-in-production-not-working/39057/9 "2023-01-28T01:15:13Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.