Auth0 Error "Oops! Something went wrong" When Pressing Browser Back Button After Enterprise SSO Login

Users encounter a dead-end Oops! Something went wrong error page when pressing the browser's Back button immediately after a successful Enterprise SSO login using OpenID Connect (OIDC) or Security Assertion Markup Language (SAML). This occurs only when the user lacks an active Identity Provider (IdP) session during the initial login. Resolve this expected behavior by configuring a custom error page that guides the user back to the application.

Oops! Something went wrong

• Auth0
• Enterprise Single Sign-On (SSO)
• OpenID Connect (OIDC)
• Security Assertion Markup Language (SAML)

When the user presses the Back button after Auth0 delivers the authorization code to the client, the browser navigates to the last page that returned an HTTP 200 response, which is the IdP login page. The IdP detects an existing session, generates a new authorization code or SAML assertion, and redirects back to the Auth0 /login/callback endpoint. Auth0 receives an unsolicited authorization code or assertion with no matching transaction record, as Auth0 already completed and destroyed the original transaction. Auth0 intentionally displays an error page rather than redirecting back to the client to prevent Cross-Site Request Forgery (CSRF) based phishing attacks and authorization code injection. For SAML specifically, the RelayState replays, causing Auth0 to treat it as a Service Provider (SP) initiated response and attempt to find the original transaction, which no longer exists.

How is the browser back button error resolved?

Configure a custom error page, educate users on browser navigation, and reference OAuth security standards to mitigate this expected behavior.

1. Configure a custom error page with a user-friendly message, such as "Please navigate to your application and restart the login process," and include a link back to the application.
2. Educate users that this behavior is a browser navigation edge case and not an application failure.
3. Review the OAuth 2.0 security best practices (RFC 9700, RFC 6749 §10.12) to understand how this behavior prevents unsolicited IdP-initiated logins via OIDC.