Auth0 Organization Branding Is Missing on Expired Password Reset Links
Last Updated:
Overview
When Auth0 generates a new password reset ticket for a user, Auth0 invalidates previous tickets and removes the associated organization context. To prevent the loss of organization branding on expired links, avoid generating multiple password reset tickets for the same user. When an end-user clicks an expired password reset link after a newer ticket is generated, the expired link page renders as a black screen without the expected organization branding and displays the following error message:
Link Expired
If a Tenant Login Uniform Resource Identifier (URI) exists, Auth0 redirects the end-user directly to the login page without displaying an expired link message.
Applies To
- Auth0
- Password Reset Tickets
- Organization Branding
- Universal Login
Cause
When Auth0 generates a new password reset ticket for a user, Auth0 invalidates all previously issued tickets for that user. This invalidation removes the stored metadata associated with the older ticket, including the organization context. Since Auth0 uses this stored ticket metadata to resolve the branding for the expired link page, losing this metadata causes the page to fall back to an unbranded rendering or a silent redirect.
Solution
How does Auth0 resolve the missing organization branding?
Currently, Auth0 does not preserve organization branding on an invalidated ticket once Auth0 issues a newer ticket for the same user. Prevent this issue by ensuring end users always click the most recently generated password reset link. When Auth0 generates a new password reset ticket, Auth0 immediately invalidates any previous tickets and removes the associated organization branding.
Auth0 Invalidates Previous Tickets When Generating a New Ticket
Generate multiple password reset tickets for a single user via the Management API to observe the loss of organization branding on the expired link page.
- Create a password reset ticket for a user via the Management API, including an
<organization_id>in the payload. - Create a second password reset ticket for the same user without using the first ticket.
- Navigate to the URL from the first password reset ticket.
- Observe that the page displays a generic expired link message without applying any organization branding.
