Why must my users authorise the app every time now?

Get Help
,
1

For several years all was fine. Then just recently, without any changes from me, the login experience seems to have changed. Now, my users are asked every time to authorise the app (see below), rather than just the first time they ever login.

How can I prevent them seeing that screen every single time, and why isn’t it remembering their choice?

image
image600×810 19.4 KB

2

Hi @kkrp1

Thank you for reaching out to us!

I understand that your users are asked each time to provide consent the application they are trying to access.

The usual resolution is to remove prompt=consent from the /authorize request, because Auth0 will re-display the consent screen on every authentication request when that parameter is present. This should also result in the consent being remembered the first time and not request it for every subsequent attempt. I recommend checking our Support Article on Users Seeing Consent Prompt on Every Login which outlines this behaviour.

In addition to the above, please also make sure that your application is marked as a First-Party Application, as these have the ability of skipping the consent screen, whereas third-party apps always require consent.

Let us know if the above have helped you overcome the issue!

Best regards,
Gerald

4

Hi @kkrp1

Wanted to return with an update on this matter and provide some additional details.

The screenshot that you shared seems to match a confirmation prompt rather than a consent screen. This is a Measure Against Application Impersonation that occurs if prompt=consent is not included in the /authorize call and is designed to prevent malicious apps from impersonating legitimate ones and receiving the authorization response (including tokens) without user awareness.

We strongly recommend you do not disable this protection for production. Malicious applications on the device could request id_tokens and access_tokens without any interaction from the user or other indications that something has happened.

If however you wish to disable the confirmation prompt, it can either be configured as a global tenant setting or at the application-level (application-level settings take precedence over the global tenant-level setting). You can view the steps for each under the link I have shared, however for added ease of access, allow me to share them below:

Application-level

  1. Navigate to Auth0 Dashboard > Applications > Application Settings > Advanced > OAuth.
  2. Scroll to the Non-Verifiable Callback URI End-User Confirmation setting.
  3. Enable the toggle to activate the prompt or disable the toggle to deactivate the prompt.

Auth0 Dashboard>Settings>Advanced
Auth0 Dashboard>Settings>Advanced602×227 24.5 KB

Global

  1. Navigate to Auth0 Dashboard > Settings > Advanced.
  2. Find the Non-Verifiable Callback URI End-User Confirmation setting.
  3. Enable the toggle to activate the prompt.

Auth0 Dashboard>Tenant Settings>Advanced>Skip Custom URI toggle
Auth0 Dashboard>Tenant Settings>Advanced>Skip Custom URI toggle500×241 18.5 KB

I believe this makes more sense for the issue that you are facing, please let us know if it helped you overcome it and if we can further assist with anything else.

Have a great one!
Gerald

5

Thanks for the replies, Gerald.

You strongly recommend not disabling this, but it’s unheard of for a login screen (anywhere) to require this consent of a user on every login, rather than just the first. Are you saying you recommend leaving it as it is, for every single login? No other (safe) way to remove this requirement from my users every time they login?

Also, what’s meant by non-verifiable callback URLs? The callback URL is to my system, which is whitelisted as a valid callback URL in the application settings.

6

Hi @gerald.czifra just wondering if you had any thoughts on the above? Also, why would this have suddenly started happening when nothing has changed on our end? Our users never had to do this previously (except on first login), so is this the result of an Auth0 update/policy change or something?

7

Hi @gerald.czifra any further thoughts here? ^^ Thanks.

8

Hi @kkrp1

Thank you for further reaching out!

As defined in the OAuth2 for Native Apps specification, Auth0 provides a mechanism to show a confirmation prompt to the user. Users confirm the application receiving the authentication result is the one they intended to access. When a non-verifiable callback URI is in use, the user is prompted to verify the application on each authentication transaction.The confirmation screen displays when:

  1. The redirect_uri present in the request uses a non-verifiable URI (i.e. a custom URI scheme or a loopback URI).
  2. The user has not been prompted with any other screen in the current login transaction (such as when a consent screen populates for third-party applications, or when MFA is required).

In these cases, the application presents the end user with a confirmation prompt that you are also seeing. This is a security measure meant to prevent Application Impersonation attacks, which as mentioned previously, you are able to disable, although we strongly recommend against doing so.

Hope this helped, have a great one!
Gerald

9

Thanks for the reply. I do understand the purpose of consent screens, I’m just unsure (still) why my users are seeing it on every login. I’m not using native apps; this is web-based.

I appreciate you say a “non-verified URI”, I’m just wondering what that actually means and how I can “verify” my URI. It’s a URI on my server, i.e. the URI the user is sent back to after login. Surely that’s normal? Yet most login flows don’t show a consent challenge on every login.

In short, while I appreciate you said I can disable this but it’s not recommended, is there a recommended way to stop my users seeing this challenge every time, or is disabling it entirely my only (though not recommended) option?

Continued thanks.