Redirect user back to login page with error message displayed

Help
,
1

We have social login with Google as the only option for login on our app now. For now, we have a allowlist of emails that are allowed to login with Google. I’ve created a post-login action that checks on a list.

I saw from posts like these: Api.access.deny and api.redirect.sendUserTo looping after call in login action that we can’t use api.access.deny because it sends the page into an infinite redirect loop. I’ve added the logout to the action and I currently have it redirecting to the entrypoint page of our app. However, what I’d like is to redirect back to login with an error message shown. I’ve tried setting the query params for error_description and error, but I can’t get the error message to show. I’ve also tried setting it to just my tenant URL, but that gives me an error.

Can someone give me some advice as to what the returnTo URL should be in order to just redirect to the login screen with an error? Do I have to setup a custom error page?

3 Likes
2

I was wondering if anyone could help me with this? Or provide an update?

3

I too am experiencing the same issue. In my use case, most users have access to only one of the many applications configured. I am using a login flow Action to control this access.

I have removed the api.access.deny() call and replaced it with api.redirect.sendUserTo(‘https://{my domain}.eu.auth0.com/v2/logout’) call which works in that the user is logged out with a simple “OK” message on the screen. If I immediately use api.redirect.sendUserTo({URL}) following the logout, I am redirected to the URL but the user was not logged out and a state value is included in the address bar and results in the infinate loop again.

When I add the returnTo parameter to the logout, I get an error that the URL is not in my Allowed Logout URL list although it most assuredly is. Another suggestion in this case is to include ‘?client_id={CLIENT_ID}’ and therein lies the rub. I need to be able to obtain the current CLIENT_ID value the user is using (which application they are attempting to login to).

The client_id can be obtained via event.client.client_id. Using this I can redirect back to the login page and the user is logged out however, there is no indication to the user that anything is wrong like why the login failed.

I expect that the web page redirected to will need to be a page that provides the “Not authorized” message.

4

did you manage to solve this issue?

5

Yes. It is almost all there in my post.

Don’t use api.redirect.sendUserTo().

Use api.redirect.sendUserTo(‘https://[your domain name].eu.auth0.com/v2/logout’ + [returnTo]);
where returnTo = ?returnTo=[URL to return to]&client_id=[client_id]
where client_id is obtained from event.client.client_id. You need to ensure the URL to return to is URL encoded. You can do that with the Nodejs encodeURIComponent() function.

6

Have you been able to display any error messages when redirected to the login page, though?

7

The page to which the user is redirected displays a message with a button to retry login.

8

And how do you pass the message to the login screen? Do you able to control the message content? Any code examples would be greatly appreciated.

Ah well, it seems you have a custom error page with redirect button to the login screen

9

That is correct. I use a custom error page with a redirect button to the login screen.

2 Likes