Btukfyl

I have a client-facing web application built using Angular 7 that utilizes Auth0 (auth0-js v9.8.2) for authentication. We require users to login using username/password and then multi-factor using Guardian/text/phone call. All of this works great. The issue is that we are seeing that sometimes users are required to authenticate/multi-factor a second time immediately after they're redirected to the application from Auth0's hosted login page. I have seen it once or twice myself but now that I am trying to debug this issue I cannot replicate the issue. However, I see in the logs that several users per day are experiencing this inconvenience.

Here are some snippets from my code. If I knew how to replicate I would try and debug, but I can't even make it happen now, although it's still happening to others currently.

The first thing I'm doing in app.component.ts is calling handleAuthentication() and requiring users to authenticate if they're not already.

constructor(private auth: Auth, private dataService: DataService) {

    this.auth.handleAuthentication().then((res: any) => {

        if (this.auth.isAuthenticated()) {

            this.authenticated = true;

        } else {

            this.auth.auth0.authorize();

        }

    });

}

Here is the handleAuthentication() function, which is resolved only once 'parseHash()' is called and the session is set.

public handleAuthentication(): Promise<any> {

    return new Promise((resolve, reject) => {

        this.auth0.parseHash({ _idTokenVerification: false }, (err, authResult) => {

            if (authResult && authResult.accessToken && authResult.idToken) {

                window.location.hash = '';

                this.setSession(authResult);

            } else if (err) {

                console.log(err);

            }

            resolve();

        });

    });

}

Here are my auth0 settings in case it's helpful

auth0 = new auth0.WebAuth({

    domain: '<domain>',

    clientID: '<clientID>',

    redirectUri: environment.callbackURL,

    audience: '<audience>',

    responseType: 'token id_token',

    scope: 'openid'

});

My only guess is that it has something to do with 'parseHash()' failing. There are a couple of other things I find interesting.

1. In other examples, I don't see { _idTokenVerification: false } being passed into parseHash(), but it was added for some reason at some point


2. I have seen others talk about issues with passing id_token into responseType, but we are using this token to check expiration. If this is could be causing an issue, I may be able to figure out a workaround

I can't just assume these are issues because I can't replicate the main issue with or without these modifications.

Any help or advice?