CORS Errors While Redirecting With Actions

Last Updated: Sep 10, 2025

Overview

When creating an Action that redirects users to an external web page, after the redirection, there is a need to send some data back to the Action on the front channel using the process outlined in the documentation Send data on the front channel. This article explains a potential cause of a Cross-Origin error when sending data back to the action.

To avoid replay attacks, the token should be sent back to Auth0 by making a POST request to the /continue endpoint. The tokenParameterName option in the code allows you to specify the name of the field that contains the token.

Applies To

Cross-Origin Errors
Actions

Cause

Making a POST request with AJAX, will cause a cors error. This is the unsupported use case.

Solution

Making a redirect or page transaction happen is necessary, letting the value in the URL bar change.

Make a GET request (not an AJAX but window.location = "https://yourdomain.auth0.com?state=xxx" or <a href="https://yourdomain.auth0.com?state=xxx">)
- Do not expose the signing secret to the front-end codes. Sign the JWT token on the backend.
Or use Form POST