Auth0 User Cannot Return to Login Screen After an Action Denies Access

When an Auth0 Post-Login Action calls api.access.deny(), the session persists and causes a redirect loop. Terminating the session by redirecting the user to the Auth0 logout endpoint resolves this issue. If a user has an active session and an Action denies access, subsequent login attempts do not prompt for credentials. Instead, Auth0 detects the active session, runs the Post-Login Action again, and calls api.access.deny() again, which continuously sends the user back to the application with the following error:

access_denied

• Auth0
• Actions
• api.access.deny()
• Post-Login Action

The api.access.deny() method in a Post-Login Action stops the authentication flow and prevents a user from logging in. However, Auth0 does not automatically terminate the existing session.

How is the redirect loop resolved?

To prevent the redirect loop and allow the user to return to the login screen, terminate the session after Auth0 denies access. Configure the Post-Login Action to redirect the user to the Auth0 logout endpoint using the following example script and implementation details.

exports.onExecutePostLogin = async (event, api) => {

    const shouldDeny = true; // Replace with your custom logic

    if (shouldDeny) {

        const logoutURL = `https://${event.custom_domain.domain}/v2/logout`;

        const redirectURI = `https://${event.custom_domain.domain}/`;

        api.redirect.sendUserTo(logoutURL, {

            query: {

                client_id: event.client.id,

                returnTo: redirectURI

            }

        });

    }

};

• api.redirect.sendUserTo(): This method redirects the user to the specified URL. Use this method instead of api.access.deny() in this scenario.
• Logout URL: The URL must be the /v2/logout endpoint for the tenant.
• client_id: This ensures that Auth0 logs the user out of the correct application.
• returnTo: This parameter specifies where Auth0 redirects the user after the logout completes, such as the application login page or a custom error page. Add this URL to the Allowed Logout URLs list in the tenant or application settings.