# Universal (hosted) login page defaults to authorization\_code flow instead of implicit flow

**URL:** <https://community.auth0.com/t/universal-hosted-login-page-defaults-to-authorization-code-flow-instead-of-implicit-flow/19868>\
**Category:** Get Help\
**Tags:** auth0, lock\
**Created:** [January 10, 2019, 2:14pm UTC](https://community.auth0.com/t/universal-hosted-login-page-defaults-to-authorization-code-flow-instead-of-implicit-flow/19868 "2019-01-10T14:14:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ottar](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ottar/32/10378_2.png) [@ottar](https://community.auth0.com/u/ottar)\
**Post date:** [January 10, 2019, 2:14pm UTC](https://community.auth0.com/t/universal-hosted-login-page-defaults-to-authorization-code-flow-instead-of-implicit-flow/19868/1 "2019-01-10T14:14:14Z")

</div>

When using Auth0 Universal standard Login page built with Lock v.11.2.1, the OpenID Connect authentication flow is automatically changed from “Implicit flow” (as specified by our SPA application) to “Authorization code” flow instead.

When investigating the Login Page I see the following code:

```
var lock = new Auth0Lock(config.clientID, config.auth0Domain, {
  auth: {
    redirectUrl: config.callbackURL,
    responseType: (config.internalOptions || {}).response_type ||
      config.callbackOnLocationHash ? 'token' : 'code',
    params: config.internalOptions
  },

```

For some unknown reason, it looks for as responseType is set to ‘code’ as consequence of the following line of code:

config.callbackOnLocationHash ? ‘token’ : ‘code’

What does this line of code do?

**About our SPA application**  
Our Angular-based SPA application is configured in Auth0 as OIDC Conformant with Implicit and Refresh Token grant types (Authorization Code is disabled).

Our SPA application is configured to use Auth0 Universal Login with the standard hosted login page based on Lock v.11.2.1.

Our Angular SPA application is built using Auth0.js v9 SDK and is configured to use Implicit authentication flow, i.e. response\_type=token id\_token

---

<div class="post-metadata">

**Author:** ![charsleysa](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/charsleysa/32/9722_2.png) [@charsleysa](https://community.auth0.com/u/charsleysa)\
**Post date:** [January 12, 2019, 1:29am UTC](https://community.auth0.com/t/universal-hosted-login-page-defaults-to-authorization-code-flow-instead-of-implicit-flow/19868/2 "2019-01-12T01:29:41Z")

</div>

Hi @ottar

The line

```auto
responseType: (config.internalOptions || {}).response_type || config.callbackOnLocationHash ? 'token' : 'code',

```

means that it will use the `response_type` specified in the request, but if none was specified then it will default to `token` or `code` based on the `callbackOnLocationHash` config.

Just as a note, when setting the parameter using the Auth0.js SDK you must use camelCase and not snake\_case for the property name (e.g. `responseType: 'token id_token')`.

Hope this helps!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [August 29, 2019, 9:30am UTC](https://community.auth0.com/t/universal-hosted-login-page-defaults-to-authorization-code-flow-instead-of-implicit-flow/19868/3 "2019-08-29T09:30:29Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.