auth0 / express-openid-connect

An Express.js middleware to protect OpenID Connect web applications.
MIT License
471 stars 145 forks source link

Have a way to configure different domain for refreshing token and accessing login page #554

Closed Will956 closed 10 months ago

Will956 commented 10 months ago

Checklist

Describe the problem you'd like to have solved

Hello 👋

We have some intermittent timeout issues when refreshing access tokens possibly related to our custom domain handled with Cloudfront.

To verify that, we would like to use our tenant.auth0.com URL when refreshing the token but keep our custom domain when going to the login page.

Describe the ideal solution

As far as I understand, we can't configure the SDK to have a different domain for refreshing the token and redirecting users to the login page.

We could develop the refresh token login on our own but that will make us desync from this SDK.

Do you see any other way to achieve that?

Thanks!

Alternatives and current workarounds

Code our own logic for the refresh token.

Additional context

No response

frederikprijck commented 10 months ago

I do not think this is something you should do because of reasons explained here: https://auth0.com/docs/customize/custom-domains#custom-domains-and-token-requests

TLDR: you will end up with different iss claim values for tokens issued on initial login and those issued as part of the refresh token grant, which will most likely open up for other issues and unexpected behavior.

Closing as this isn't a feature we intend to support.