"Access Deny" from Action Shows No Error
Last Updated:
Overview
A Passwordless connection has been configured in a tenant using New Universal Login.
Registration of new users is regulated through a Pre-User-Registration Action that conditionally denies access with the blocking condition:
api.access.deny("ERROR FOR LOGS", "ERROR FOR USER")
This article explains why the New Universal Login widget does not show the "ERROR FOR USER" message when the 'deny access' condition is triggered.
Applies To
- Actions
- Error Messages
Cause
During a Registration (or Login) flow, any error condition that would deny access to the user will fail silently. No message will be displayed to the blocked user. This is by design, to avoid user-enumeration attempts, in which an attacker repeatedly attempts to gain access to an application. For further information, refer to OWASP Authentication Cheat Sheet
If a user is not permitted to Sign Up for any reason, the tenant logs are updated with details of the blocked attempt.
- Login to the Auth0 dashboard.
- Navigate Monitoring > Logs.
- Search for Failed Signup ( fs ) events.
Solution
Auth0 does not currently provide an option to display a message to a blocked user. Customers who require this capability are encouraged to submit a feature request via our Customer Feedback form. This will help our Product team to prioritize features for future release of Auth0.
