If you scroll down at https://auth0.com/lock/ to modes it will display multiple modes: "overlay", "embed", "hosted" and "mobile ready". I am allowed to embed the login from auth0 to show up on my site (without redirecting to their site hosting their login service).

Thiefs can easily fake the layout of the login, couldn't they? I thought end-users could only be sure their credentials aren't stolen by entering it on a fake site if the end-user can compare the url of the current site to the site his account is on/the service he wanted to lock in with. Why does auth0 still offer me to embed their login on my site?

I mean there are some sites on the internet you would trust to not steal your auth0 (or any other login service provided by auth0) credentials, but they offer it to everyone.

2 Answers 2


Why does auth0 still offer me to embed their login on my site?

The authentication system that auth0 provides doesn't offer users to enter their "auth0 customer credentials". Rather, the credentials are unique to the site that's embedding the form.

You are right in that it's only safe to enter your login details in an embedded form if you trust the page hosting it. That's why social login features like "Login with Google" always redirect you to a secured login page of the social identity provider and should never ask you to enter your credentials directly on the initial (potentially untrusted) page.


Your Auth0 client has an option to configure Allowed Origins - this determines which origins are allowed to perform resource owner password grant flows (i.e. active authentication), since these flows are performed by making a cross-origin request to Auth0. This way an attacker on a different origin than the original website cannot spoof your login endpoint, at least not directly, but they could still potentially steal your users' credentials by just capturing them anyway.

We plan to roll out the option to disable resource owner password grants for specific clients, but as of today it's possible to restrict these logins by using a rule:

function (user, context, callback) {
  if (context.protocol === 'oauth2-resource-owner') {
    return callback(
      new UnauthorizedError('The resource owner endpoint cannot be used.'));
  callback(null, user, context);

As you point out, the more secure way of performing authentication is to redirect users to the identitiy provider. Auth0 supports this as well and is our recommended option whenever possible.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .