Redirecting Users to a Signup Page if Account Does Not Exist

Knowledge Articles
,
1

Overview

This article explains whether Auth0 supports using an identifier-first flow, where the user is taken to a login page if the user exists or a signup page if the user does not exist.

Applies To

  • Redirecting
  • Identifier-first
  • Login Page
  • Sign Up Page

Solution

Auth0 does not support redirecting a user to a login or sign-up page based on whether the user exists.

  • This flow introduces a security vulnerability for user enumeration attacks.
  • If bad actors can differentiate between an account that exists and an account that does not exist, then attackers can easily narrow down which users exist within an organization.

Please see the OWASP specifications for more information on this topic.