Writing automated tests, we found an unexpected behavior regarding the URLs to our tenants, or rather the tenant endpoints. We found that the actual URL used to access the token endpoint is not relevant, we would still get a valid access token back, as long as the contents of the request is consiste…

You’re right, Auth0 doesn’t validate the tenant name in this particular /oauth/token request, and infers the tenant using the clientID specified in the body. Fixing this is in our backlog, but not prioritized at the moment due to lack of security implications and there’s a possibility for the flows …

Tenants are not isolated by domain (URL)?

Get Help

martin.osterberg January 10, 2019, 8:24am 4

Thanks for the explanation!

/Martin

Topic		Replies	Views
Auth0 client can authenticate to another tenant?? Get Help jwt , auth0 , login , access-token	1	4502	June 3, 2020
Access token issuer and unisolated domains Get Help tenant	1	3111	July 30, 2020
Cross domain authentication using the password grant flow Get Help authentication-api , password-grant , security-questions	2	4184	August 20, 2019
Tenant Validation: What is the workaround auth0 Clients should follow? Get Help	3	3071	December 6, 2020
Auth0 not respecting multi-tenancy Get Help jwt , api , multi-tenant	3	3395	March 24, 2020

Tenants are not isolated by domain (URL)?

Related topics