Missing client id query parameter on custom error page

Help
, , ,
1

Hi everyone

I ran into the problem that the client id is not passed as a query parameter to the custom error page. There are error and error_description query parameters, but client id is empty.

I use this method

What could be the problem?
Thanks

2

There are scenarios where the error page might be called where the client ID is unknown. Can you give an example where this is happening? I just tested this out in my own tenant, and anytime I call /authorize or /login and pass a client_id parameter, (and intentionally create an error that goes to the error page), I had the client_id. Obviously, if I called /authorize or /login without a client_id I don’t get one, but I do still get the client_id parameter, but the value is empty.

3

Sorry for so late response Carlos, I didn’t see a notification.

The exact steps to reproduce the issue:

  1. Navigate to hosted login page from the client site
  2. Login or signup. After that user is redirected to redirect_uri (back to the client site)
  3. press browser back button and try to login or signup
  4. An error occurs and a custom error page is showed with missing client_id query param

Error would be the following: Password login via OIDC-conformant clients with externally-hosted login pages is unsupported. Alternatively, login could have been initiated from the wrong place (e.g., a bookmark).

Any thoughts?
Thanks in advance

4

It must be getting the client_id out of the session, which would no longer exist after a successful login.

As for this particular error, we have a feature in beta right now that a few customers are trialing that allows you to configure either a tenant level or client level URL where you can redirect a user to if they login using the back button or a bookmark (basically any scenario where the login session is no longer valid). Watch the product announcements for it to arrive soon!

Please NOTE, the URL should be a login URL that will redirect the user back to /authorize at Auth0. If they had previously logged in, they will be directed to your callback automatically with the appropriate state.