Next-auth: silent login on multidomains

[gagalago]

Your question
How can we achieve to log in a user on a second domain without asking him again his credentials?

What are you trying to do
We are investigating to use this lib to manage the authentication of users and we wanted to know if this lib can fit our requirement:

• using auth0 behind the scene (OK)
• allow silent authentication
• allow single logout on multidomain (see https://github.com/iaincollins/next-auth/issues/440)

In Auth0, they provide silent authentication that allow to perform the oauth2 code flow to auth0 and if the user has a session on auth0, the flow will resolve directly, otherwise the flow will fail directly.
I didn't find if it's possible to achieve something similar with next-auth. maybe with callbacks but it's not clear how to use them in this case.

Documentation feedback
don't see anything in the documentation about multidomain

• [ ] Found the documentation helpful
• [ ] Found documentation but was incomplete
• [x] Could not find relevant documentation
• [x] Found the example project helpful
• [ ] Did not find the example project helpful

[iaincollins]

This is a great feature of Auth0 but it is not currently supported as a built-in feature of NextAuth.js.

Often this feature is supported using Window PostMessage and offscreen iFrame which talks to the site at a configured URL and relies on correctly configured CORS headers.

I'm happy to accept a feature request for this!

[stale[bot]]

Hi there! It looks like this issue hasn't had any activity for a while. It will be closed if no further activity occurs. If you think your issue is still relevant, feel free to comment on it to keep ot open. Thanks!

[mikestopcontinues]

@gagalago Did you go forward with the iframe idea? How did you get it set up? I'm thinking of going down the same path.

[gagalago]

@mikestopcontinues I didn't go forward especially because silent authentication is deprecated because of new browser security measures https://auth0.com/docs/authorization/configure-silent-authentication. So it's better to use refresh token rotation. At the end, I used directly the library from Auth0 https://github.com/auth0/auth0-spa-js (you can find specific packages base on this generic one for for React, Angular...)

[mikestopcontinues]

Thanks! I really appreciate the help!