Why must my users authorise the app every time now?

Get Help
,
1

For several years all was fine. Then just recently, without any changes from me, the login experience seems to have changed. Now, my users are asked every time to authorise the app (see below), rather than just the first time they ever login.

How can I prevent them seeing that screen every single time, and why isn’t it remembering their choice?

image
image600×810 19.4 KB

2

Hi @kkrp1

Thank you for reaching out to us!

I understand that your users are asked each time to provide consent the application they are trying to access.

The usual resolution is to remove prompt=consent from the /authorize request, because Auth0 will re-display the consent screen on every authentication request when that parameter is present. This should also result in the consent being remembered the first time and not request it for every subsequent attempt. I recommend checking our Support Article on Users Seeing Consent Prompt on Every Login which outlines this behaviour.

In addition to the above, please also make sure that your application is marked as a First-Party Application, as these have the ability of skipping the consent screen, whereas third-party apps always require consent.

Let us know if the above have helped you overcome the issue!

Best regards,
Gerald

4

Hi @kkrp1

Wanted to return with an update on this matter and provide some additional details.

The screenshot that you shared seems to match a confirmation prompt rather than a consent screen. This is a Measure Against Application Impersonation that occurs if prompt=consent is not included in the /authorize call and is designed to prevent malicious apps from impersonating legitimate ones and receiving the authorization response (including tokens) without user awareness.

We strongly recommend you do not disable this protection for production. Malicious applications on the device could request id_tokens and access_tokens without any interaction from the user or other indications that something has happened.

If however you wish to disable the confirmation prompt, it can either be configured as a global tenant setting or at the application-level (application-level settings take precedence over the global tenant-level setting). You can view the steps for each under the link I have shared, however for added ease of access, allow me to share them below:

Application-level

  1. Navigate to Auth0 Dashboard > Applications > Application Settings > Advanced > OAuth.
  2. Scroll to the Non-Verifiable Callback URI End-User Confirmation setting.
  3. Enable the toggle to activate the prompt or disable the toggle to deactivate the prompt.

Auth0 Dashboard>Settings>Advanced
Auth0 Dashboard>Settings>Advanced602×227 24.5 KB

Global

  1. Navigate to Auth0 Dashboard > Settings > Advanced.
  2. Find the Non-Verifiable Callback URI End-User Confirmation setting.
  3. Enable the toggle to activate the prompt.

Auth0 Dashboard>Tenant Settings>Advanced>Skip Custom URI toggle
Auth0 Dashboard>Tenant Settings>Advanced>Skip Custom URI toggle500×241 18.5 KB

I believe this makes more sense for the issue that you are facing, please let us know if it helped you overcome it and if we can further assist with anything else.

Have a great one!
Gerald

5

Thanks for the replies, Gerald.

You strongly recommend not disabling this, but it’s unheard of for a login screen (anywhere) to require this consent of a user on every login, rather than just the first. Are you saying you recommend leaving it as it is, for every single login? No other (safe) way to remove this requirement from my users every time they login?

Also, what’s meant by non-verifiable callback URLs? The callback URL is to my system, which is whitelisted as a valid callback URL in the application settings.