"Back to (Application Name)" Button Fails to Display or Falls Back to the Auth0 Global Tenant Settings on Invalidated/Expired Password Reset URL

This article explains how the Back to (Application Name) button behaves when the password reset URL has expired or is invalid.

When an end user visits an expired or invalidated Universal Login password reset URL, the page displays the Back to (Application Name) button if the Application Login URI configuration exists. 

However, the button sometimes fails to display or falls back to the global tenant settings, which combine the Tenant Friendly Name and Tenant Login URI.

Example of a Password Reset URL or "Ticket":

https://(tenant domain)/u/reset-verify?ticket=<value>

Application Name and Application Login URI Settings:

Tenant Friendly Name and Tenant Login URI Settings:

• Auth0
• Password Reset
• Universal Login

A password reset URL has a configurable lifetime.

Even after a URL expires or becomes invalid after consumption, the URL ticket retains client information while the database stores the ticket record. This allows the Universal Login page to display client information, including the Application Name and Application Login URI.

Once the database drops the ticket record, the Universal Login page fails to retrieve client information. Consequently, the Back to (Application Name) button fails to display or falls back to the global tenant settings, if configured.

NOTE: Documentation does not disclose the duration the database stores the record.

Common scenarios include:

• The URL experiences normal consumption:
  • The Universal Login page displays the Back to (Application Name) button until the database drops the ticket record.
• The URL expires:
  • The Universal Login page displays the Back to (Application Name) button until the database drops the ticket record.
• A user clicks the Resend email button:
  • The system immediately invalidates the previous URL and drops the ticket record. The Back to (Application Name) button fails to display or falls back to the global tenant settings for the invalidated URL.

Configure the global settings to allow the button to fall back to them when client information is unavailable.