This is a reproduction repo for the following workflow requirement on auth0:
- Create a user.
- Silently log him in (the user typed his password once when entering his infos, we don't want to ask him again for credentials or prompt him for a consent).
- redirect him to a page on a nextjs app that requires a session.
- Front - Signup form - Have a form that targets a next server action. In real world we would have form data submitted to the action (email, password, etc..).
- Backend - User creation - User creation on auth0 user database using
auth0node library. - Backend - Silent login - calling
/oauth/tokento retrieve anid_tokenand anaccess_token. - Backend - Session payload - Generate a payload for the session to be stored on one or several cookies, depending on payload size.
- Backend - Encrypt payload - Encrypt the session payload using auth0 secret generated earlier.
- Backend - Cookie creation - Set session cookie.
- Backend - Redirect - Finally, redirect to
/. - Frontend - User is logged in - See the user as logged in, per
@auth0/nextjs-auth0.
We essentially extracted logic from nextjs-auth0:
Ideally, we would have preferred to use nextjs-auth0 code for this, as redefining this logic in our own codebase exposes us to a regression risk if the logic changes in nextjs-auth0 lib.
When we redirect after setting a cookie, we have to do a client side refresh on the page; otherwise, the session will not be present client side.
See 48434