Illegal Domain Attribute Warning for eu.auth0.com

This article explains the cause of the following warning message:

illegal ‘domain’ attribute “eu.auth0.com”

• Custom domains

• Self-managed certificates

The __cf_bm cookie in the response has the domain set to .eu.auth0.com despite the request using a custom domain. This occurs when using self-managed certificates because the origin edge server is not aware of the domain.

• The __cf_bm cookie originates from Cloudflare, not Auth0, and is part of the Cloudflare bot management service.

• When using self-managed certificates, the tenant origin domain is configured at the reverse proxy. The edge server of the origin domain resides at Cloudflare. Since the origin domain is under the eu.auth0.com subdomain and the custom domain is not configured with Cloudflare, the __cf_bm cookie uses the eu.auth0.com domain.

• When using an Auth0-managed domain, the __cf_bm cookie reflects the custom domain because Cloudflare is aware of the domain. This does not apply if the request goes directly to the edge.

• Ignore this warning.