Hello! I’ve configured auth0-chrome on an extension and auth0-spa-js on a SPA. Both applications use the same Auth0 tenant, however when a user logs in/out in one application, they don’t automatically get logged in/out the other application. The user has to enter their credentials each time, to lo…

I’ve managed to use the auth0-spa sdk loginWithPopup() with success. It offers the same experience as the auth-chrome but with none of the drawbacks: It syncs the login state through cookies The popup has a url bar so the user can verify they are introducing the credentials in the right domain @d…

@minibar what’s your setup on the auth0-spa, particularly on the redirect_uri? i’m trying to achieve the same thing with migrating from auth0-chrome.

@warex03 if with redirect_uri you mean the callback url you can use the origin of the page where the login is initiated i.e chome-extension://92fji2j3f093feereouw. If that page is a chrome extension page, like chrome-extension://92fji2j3f093feereouw/…), you will have to use the loginWithPopup() meth…

@minibar thanks for the quick reply! it seemed to work, at least im not getting an error with the popup now. i tried running it in a background script but i’ll try to figure out how to wire it up with our backend. ideally, we want it to work with google sign in and get the idp access token and also …

hey @minibar - I’m currently trying out the same, but unfortunately, the redirect doesn’t seem to work. I can authenticate succesfully in the PopUp, this is closing the whole extension window. When opening again, I’m not longer authenticated - any ideas?

@jannik I don’t see why the an window window should be closed after you authenticate using loginWithPopup(). What window are you referring to?

Hi, thank you for answering. I could fix the issue myself by using cacheLocation='localstorage' Otherwise, auth0 just sets the cookie in the open popup, which is not persistent. On closing of the popup I was no longer authenticated. Like this it’s working :slight_smile:

A popup is like any other window and cookies will be persisted as if you were authenticating in a separate tab – assuming you are using auth0-spa-sdk, and not the deprecated auth0-chrome sdk

[image] jannik: localstorage storing credentials in localstorage has security implications

I would like to echo the sentiment from @minibar , localstorage can cause some security concerns. With that said, the new refresh token rotation flow allows for the storage of rotating refresh tokens in localstorage. You can set the storage location in the spa sdk with the cacheLocation options, I …

As far as I understand, refresh tokens in local storage (and its security vulnerabilities) could be avoided if auth0 allowed the inactivity timeout to be increased to more than 3 days: [image] Is there a reason why auth0 doesn’t allow this setting to be increased in dev plans, and is instead sugg…

Sync auth state between multiple applications (SPA & Chrome Extension)

Get Help

Topic		Replies	Views
Auth0-chrome alternative for login from chrome extension Get Help chrome-extension	20	6814	May 9, 2021
Ultimate Guide to Auth0 In a Chrome Extension Popup Get Help auth0 , api , login , firefox , chrome-extension	9	18954	May 11, 2021
Re-authenticating the user Get Help	2	4027	January 21, 2021
Why is authentication lost after refreshing my single page application in Chrome? Get Help authentication , silent-auth , silent-authenticatio , auth0-spa-js	6	4109	September 18, 2021
Need help selecting correct auth flow for chrome extension Get Help	13	4205	July 4, 2024

Sync auth state between multiple applications (SPA & Chrome Extension)

Related topics