I currently try to implement progressive profiling with auth0 according to: https://auth0.com/blog/using-redirect-with-actions-to-gather-user-info-and-increase-conversions/ to gather first name and last name of a user after a succesful registration. Since I am using the new universal login mechanism I can not just add additional fields to the registration form.


  1. The user logs in via auth0
  2. An auth0 post login action redirects to a custom page on my angular web ui with a redirect url including a state variable
  3. A form for the additional fields is presented to the user
  4. User enters info
  5. Now, auth0 recommends encoding the fields into a jwt and sign it with a shared secret, also known by the auth0 action
  6. A redirect to auth0 continue endpoint using the redirect url (including the state parameter) and the jwt as a param.
  7. The action decodes the jwt using the shared secret and updates the user meta data

This kind of works, however I am not sure how I should securely encode the jwt in my client. I guess this is not possible at all? My frontend also has a spring boot backend. Does it make sense to implement an "open" endpoint there which creates the jwt using the shared secret which can be stored there securely? Is this approach inherently insecure?

The blogpost also states this example: https://glitch.com/edit/#!/okta-cic-pp-demo. I guess this the basically the implemention approach with the open endpoint in the backend?

  • Welcome to the community. So your goal is to log first and last names from the successful login sessions or what? Oct 3 at 11:53
  • Thanks! My goal is that upon a first (or second, or what ever) succesful login after the registration (with auth0) the user gets prompted for first name and last name on a page (angular)hosted by me. Okta described the concept in the linked blog post. They suggest that the user is redirected with a signed jwt containing the first and last name from my page back to their /continue endpoint, so that the auth0 action can decode the jwt and update the profile. My question is how (or where) I should sign the jwt. If I do it in my backend I probably need to do it with an open (unprotected) endpoint?
    – Christian
    Oct 3 at 17:43
  • I don't get it why do you ask for that data if (I make an assumption here) the data is already used for auth?... Oct 4 at 19:28


You must log in to answer this question.

Browse other questions tagged .