Silent Authorization not working after login/signup

[TanBeige]

Extremely worried right now.

My application is having a problem with user silent aauthentication.

After a user logs in/signs up, the silent authentication fails and they are sent to the signup page (using Auth0 Universal Login). After being sent to the login page, it sees that they are already logged in so they get redirected back to my website, in which silent auth fails again and sends them to the sign up page, and this loops on forever.

I’ve noticed this problem only occurs on Safari (our target audience are mobile users). But since most of our uers use iPhone to access the website, the problem might occur on other web browsers, I just have only seen it on Safari.

I have a feeling it is a problem with Safari’s cookies, as stated in this Auth0 post I saw:

Failed Silent Auth - Login required

As far as Safari, is there a way of turning off ITP2? Preferences > Privacy > Uncheck “Prevent cross-site tracking” (I had to restart the browser for the change to take effect). This isn’t mean to be tracking software (I hope) Absolutely not, it’s just that our cookies get caught up in the net that Apple has cast in order to try and prevent those cookies that aim to track you across the web. It’s also worth mentioning that this is not a problem limited to Auth0, either.

but I’m not sure how I would fix this problem. Is this with Auth0 or do I have to configure a certain way for the cookies to work on Safari?
Any help is much appreciated!

Thanks,
Tan

[steve.hobbs]

@TanBeige

Is this with Auth0 or do I have to configure a certain way for the cookies to work on Safari?

The issue you’re seeing (as pointed out in the thread you mention) is that third-party cookies are being blocked in Safari (thanks to its ITP technology), and you will find the same thing in other browsers that also block third-party cookies (such as Brave, with its shields up). While not a tracking cookie, Auth0 still relies on the ability to transmit this cookie in order to perform silent reauthentication.

This is mostly with us to find another way to allow silent reauthentication without using this cookie. We currently have a beta release of the SDK that would allow you to use local storage to keep your access token for longer (surviving page refreshes), although it doesn’t solve the whole problem as it depends on the expiry of your access tokens. We have more advancements in this area coming too.

Primary release notes for the beta are here: Release v1.7.0-beta.1 · auth0/auth0-spa-js · GitHub

It can be installed using npm install @auth0/auth0-spa-js@beta.

[johns1]

Is there any update on this? I’m still having this issue.

[kideq]

we’re having this issue also. Safari and other browsers are not surviving page refresh.

[betmix-matt]

If you add cacheLocation="localstorage" to your Auth0Provider element it will fix your page refresh issue.

However, the issue of silent auth failing on Safari is still a problem.

[Hipsterion]

I’ve been searching for this answer for some time. Thanks

[Saltuk]

You may enable the rotational refresh tokens for your single-page applications. With Refresh Token enabled calls to renew the tokens don’t depend on cookies so it will help to avoid 3rd party cookie limitations.

Set the useRefreshTokens option to true for the auth0-spa-js library.

await createAuth0Client({
  domain: '<AUTH0_DOMAIN>',
  client_id: '<AUTH0_CLIENT_ID>',
  redirect_uri: '<MY_CALLBACK_URL>',
  useRefreshTokens: true
});

Along with this change in the application configuration, you need to enable the Refresh Token.