How to Clear the Auth0 Session Cookie Inside an Action

In a scenario where a user is authenticating via a custom Multi-Factor Authentication (MFA) page, the session cookie is not cleared after an unsuccessful MFA attempt. This issue causes subsequent authentication attempts to bypass the login and password page and redirect directly to the MFA page. Configuring an Action to redirect the user to the first allowed logout URL clears the session cookie and resolves this issue.

• Auth0
• Session Cookie
• Custom Multi-Factor Authentication (MFA)
• Actions

An unsuccessful MFA attempt in a custom MFA page does not automatically clear the session cookie.

What steps clear the Auth0 session cookie using an Action?

Configure an Action that will redirect the user to the first Allowed Logout URL configured in the Application used to perform the login flow:

const returnTo = event.client.client_id;
api.redirect.sendUserTo(`https://art-ent.us.auth0.com/v2/logout?client_id=${returnTo}`);