Persisting login on refresh with refresh token rotation

[Hermit]

Hi, i’m new to auth0. so i have this issue with persisting login on my react app. i’m having this issue for a week, and i’m using auth0-react library.

So the problem is auth0 is never persisting my login even if i try to run on auth0 React-sample app and connect it with my own auth0 dashboard. the only way i found to persist my login is to save it on localstorage by adding cacheLocation="localstorage" props on my Auth0Provider component, i know about the exposure to XSS attack, and i don’t actually want to apply this way. am i missing something? can someone enlighten me?

[stephanie.chamblee]

Hi @Hermit,

You may find these topics helpful:

Trying the new Refresh Token Rotation in a React SPA. Are 3rd party cookies supposed to be required?

Nice to see Refresh Token Rotation shipped today, congrats Auth0 team! So I’m trying to test it out using @auth0/auth0-spa-js v1.7.0 on a minimal React SPA (deploy, repo) carefully following what I think should be the relevant quickstart from the docs. I used create-react-app + TypeScript and things are pretty vanilla, here’s the refresh token opt-in OK, so here’s the GIF of what’s going on: [cookieissue] TL, DR: 3rd party cookies appear to be required for ‘silent auth’ aka the refresh butt…

Why is authentication lost after refreshing my single page application?

Question: Why is authentication lost after refreshing my SPA? Answer: There could be a few different reasons why authentication is lost after refreshing a single page application. Common reasons are 1) Auth0 developer keys are being used instead of your own credentials for a social connection or 2) the browser is blocking third-party cookies. 1) Social connection settings To figure out which problem you might be facing, you can check to see if authentication is lost for database connections …

This behavior is caused by the browser blocking third-party cookies during silent authentication. Items stored in memory are lost on page refresh, including the Access Token and Refresh Token stored there. When this happens, the SDK will use silent authentication with an iframe and pass third-party cookies. However, as you have observed, third-party cookies are blocked by many browsers. You can use Auth0’s Custom Domain functionality to avoid this issue without using local storage.

[Hermit]

firstly, thank you for replying.
now i get it. i’m gonna look into these discussion, so in summary with custom domain i can bypass this third-party cookies issue then. okay i’m also gonna look to this custom domain, thanks again.