Auth0

Overview

Auth0, an Okta company, is an identity-as-a-service platform that provides authentication, authorization, and single sign-on (SSO) infrastructure for web and mobile applications. Developers integrate Auth0 to handle login flows, user registration, multi-factor authentication (MFA), social login, and enterprise identity provider (IdP) federation — offloading the complexity and security risk of building authentication in-house. Auth0 powers the login experience for thousands of applications across enterprise, startup, and consumer contexts.

What This Script Does

The Auth0 JavaScript SDK (cdn.auth0.com/js/auth0-spa-js/*/auth0-spa-js.production.js) and Auth0's Universal Login page manage the full authentication lifecycle:

Login and session management

• Renders login forms (email/password, social provider buttons) either inline using Auth0.js or via a redirect to Auth0's hosted Universal Login page at {tenant}.auth0.com
• After successful authentication, issues access tokens, ID tokens (JWTs), and optionally refresh tokens
• Sets cookies for session persistence: auth0 session cookie (server-side, HTTPOnly, scoped to the Auth0 tenant domain) and auth0.{clientId}.is.authenticated in localStorage (client-side, used by the SPA SDK to track login state)
• Manages silent authentication via hidden iframes to refresh tokens without user interaction
• Sets CSRF protection cookies (_csrf) scoped to the Auth0 domain to prevent cross-site request forgery during login flows

Multi-factor authentication

• Orchestrates MFA challenges: TOTP (Google Authenticator), SMS OTP, push notifications, and WebAuthn/FIDO2 hardware keys
• MFA state is managed via short-lived session cookies during the authentication flow

Social and enterprise login

• Redirects to external identity providers (Google, Microsoft, GitHub, SAML IdPs, LDAP/AD) and handles the OAuth 2.0 / OIDC callback
• Normalizes user profiles from external providers into a consistent Auth0 user object

Consent & Compliance

• Category: Essential — authentication is strictly necessary for accessing protected application functionality
• GDPR: Auth0 cookies are essential for authentication and session management. They do not require consent under GDPR — authentication is necessary for the performance of a service contract (Article 6(1)(b)). Consent is not the appropriate legal basis for essential authentication cookies.
• Data transfers: Auth0/Okta is a US company. Authentication data (user credentials, tokens, profile data) is processed in the US and optionally in EU data centers. Auth0 offers Private Cloud deployments and EU-region tenants for data residency. EU-US Data Privacy Framework applies.
• Security posture: Auth0 is SOC 2 Type II certified, ISO 27001 certified, and HIPAA compliant. Its infrastructure is a high-value security target — organizations should enable anomaly detection, brute-force protection, and MFA enforcement in Auth0 settings.
• Cookies set: auth0 (session, HTTPOnly, Auth0 domain), _csrf (session, Auth0 domain), auth0.{clientId}.is.authenticated (localStorage, application domain, 3 days by default)

Should You Block This Without Consent?

No consent required. Auth0 is an essential authentication service. Its cookies and scripts are necessary to operate the login system and maintain user sessions — they are exempt from consent requirements under GDPR and ePrivacy. Include Auth0 in your privacy policy as an infrastructure processor, but do not gate it behind a consent banner.