Social login session persists after blocking unregistered users — silent re-auth loop

Get Help
,
1

We are blocking unregistered social login users (Google/Apple) in a Post-Login Action. When a user who is not registered in our system authenticates via a social provider, we block them and redirect them to an informational screen.

Problem:

Despite blocking the user in the Post-Login Action, the social provider SSO session remains active. This causes the application’s silent authentication to immediately re-trigger, re-authenticate via the social provider, and hit the Post-Login Action again — creating a continuous loop.

We have tried:

  • Deleting the Auth0 user — the social provider re-creates it on the next silent auth
  • Deleting Auth0 sessions via DELETE /api/v2/users/{id}/sessions — the session is re-created immediately
  • Unlinking the social identity via DELETE /api/v2/users/{id}/identities/{provider}/{user_id} — reduces the loop but does not fully stop it as a new identity is created on the next attempt

Question:

What is the recommended approach to fully invalidate a social provider session from within a Post-Login Action so that silent re-authentication cannot occur after a user is blocked?

3

Hi @aravind.ps

Thank you for reaching out to us!

I understand that you are asking how to stop an Auth0 social login loop when a Post-Login Action blocks an unregistered user, but the external social provider session remains active and silent authentication immediately attempts to sign the user in again.

The short answer is that a Post-Login Action cannot fully invalidate the external social provider session, so the recommended approach is to clear the Auth0 session, avoid silent re-authentication for the blocked path, and use federated logout only where the social provider supports it.

If you happen to be using the api.access.deny() method in your Post-Login Action, this is designed to stop the authentication flow and prevent a user from logging in, however, it does not automatically terminate the user’s existing session with Auth0. In order to resolve this issue, you need to redirect the user to the Auth0 logout endpoint from within the Post-Login Action.

Allow me to share the following Post-Login Action script example which first denies access and then immediately redirects the user to the logout endpoint. The returnTo parameter in the logout URL should be set to the application’s login page or a custom error page:

exports.onExecutePostLogin = async (event, api) => {
  const shouldDeny = true; // Replace with your custom logic

  if (shouldDeny) {
    const logoutURL = `https://${event.tenant.domain}/v2/logout`;
    const redirectURI = `https://${event.tenant.domain}/`; // Or a custom error page

    api.redirect.sendUserTo(logoutURL, {
      query: {
        client_id: event.client.id,
        returnTo: redirectURI
      }
    });

    return; // Stop further execution
  }
};

Key Implementation Details:

  • api.redirect.sendUserTo(): This method redirects the user to the specified URL. It should be used instead of api.access.deny() in this scenario;

  • Logout URL: The URL must be the /v2/logout endpoint for the tenant;

  • client_id: This ensures that the user is logged out of the correct application;

  • returnTo: This parameter specifies where the user should be redirected after the logout is complete. This URL must be added to the Allowed Logout URLs list in the tenant or application settings.

I highly recommend the following resources for more details:

Hope this helped, please reach out to us for any other issues or requests and we will gladly look into it for you!

Have a great one,
Gerald