Simplifying Auth0 Email Verification and Additional Details Flow

Help
,
1

I’m seeking help to determine whether my current implementation of an Auth0-based email verification and additional details flow is overly complex and, if so, how it can be improved. I need to meet the following requirements using Auth0:

  1. Email Verification: The user must verify their email before proceeding.
  2. Additional Details: After verifying their email, the user is prompted to fill out a form with additional details (e.g., name, surname, country, etc.) on our webpage.
  3. Logged-In State: Once the form is submitted, the user is considered logged in.
  4. Profile Updates: In the future, the user can update these details using a similar form.

My Current Solution

Here’s how I’ve implemented the flow:

1. Post-Login Trigger with Two Actions:

  • Action 1: Check Email Verification

    • If the user’s email is not verified, they are redirected to a static page with a message prompting them to verify their email via the confirmation link.

  • Email Verification Redirect:

    • In the Branding → Email Templates section of the Auth0 tenant configuration, I’ve set the redirectTo parameter to our /login endpoint. When the user clicks the email verification link, they are redirected to the /login path, triggering the second action.

  • Action 2: Redirect to Update Details

    • This action redirects the user to the /update-details page with an encoded JWT token appended as a query parameter.
      Example code snippet:
      const token = api.redirect.encodeToken({
  secret: REDIRECT_SECRET,
  payload: { email },
});

api.redirect.sendUserTo(UPDATE_REDIRECT_URL, {
  query: { session_token: token },
});
      • The JWT token contains the user’s email to prepopulate the form on the /update-details page.
      • The token is signed with REDIRECT_SECRET because at this stage, the Auth0-issued token is not yet available, as the post-login flow is incomplete.

2. Handling the Form Submission on /update-details:

  • The form collects user input and submits it, along with the signed JWT and the state query parameter from Auth0’s redirect.
  • On the server:
    • The JWT is verified using REDIRECT_SECRET.
    • The submitted details are updated in the Auth0 user metadata via the Management API.
    • Finally, the server redirects the user back to Auth0 with the state parameter to complete the authorization flow.

3. Completion:

  • Auth0 resumes the flow, issues tokens, and redirects the user to the original callback URL.

Question:

I want to know if my solution is unnecessarily complex and, if so, how it can be simplified while still meeting the requirements. Are there any best practices or simpler approaches I can follow to achieve this? Specifically, is my approach of using a signed JWT and handling the additional details in this manner appropriate?

To summarize, I need guidance on whether my implementation is correct or overly complicated and how I can improve it while fulfilling all the requirements.