I currently try to implement progressive profiling with auth0 according to: https://auth0.com/blog/using-redirect-with-actions-to-gather-user-info-and-increase-conversions/ to gather first name and last name of a user after a succesful registration. Since I am using the new universal login mechanism I can not just add additional fields to the registration form.
Basically..
- The user logs in via auth0
- An auth0 post login action redirects to a custom page on my angular web ui with a redirect url including a state variable
- A form for the additional fields is presented to the user
- User enters info
- Now, auth0 recommends encoding the fields into a jwt and sign it with a shared secret, also known by the auth0 action
- A redirect to auth0 continue endpoint using the redirect url (including the state parameter) and the jwt as a param.
- The action decodes the jwt using the shared secret and updates the user meta data
This kind of works, however I am not sure how I should securely encode the jwt in my client. I guess this is not possible at all? My frontend also has a spring boot backend. Does it make sense to implement an "open" endpoint there which creates the jwt using the shared secret which can be stored there securely? Is this approach inherently insecure?
The blogpost also states this example: https://glitch.com/edit/#!/okta-cic-pp-demo. I guess this the basically the implemention approach with the open endpoint in the backend?
