← Back

Cross-Domain SSO

Brand A storefront · token-session-explainer-demo.vercel.app

Architecture & Token Flow
Cross-Domain SSO session transfer token flow diagram
Brand A

Sign in here first. This app authenticates against the tenant's default domain, idp-aquamarine-damselfly-66200.cic-demo-platform.auth0app.com — a different Auth0 domain than Brand B.

Sign in to Brand A
Security Implications

Strengths

  • Bridges two genuinely different origins (different domains, same tenant) via a Session Transfer Token instead of relying on third-party cookies, which browsers increasingly block by default.
  • The prompt=none silent-SSO check demonstrates the correct failure mode across domains (login_required) rather than a broken 500.

Risks & Considerations

  • Same STT-audience-confusion class of risk as native-to-web — a token minted for Brand A being redeemable against Brand B's audience would be a cross-tenant-boundary bypass.
  • A verified custom domain (Brand B) and the default tenant domain (Brand A) look identical to an end user; phishing risk increases if users can't tell which is legitimate.
  • This demo currently runs with session_transfer.enforce_device_binding set to "none" on Brand A. IP-bound device binding is a real anti-theft control — it stops a stolen STT from being redeemed anywhere other than the browser that minted it. It's disabled here only because the mint call runs server-side (Vercel serverless), so Auth0 saw the server's outbound IP rather than the end user's, and every redemption failed with a device-binding mismatch. Do not disable this in production; either mint the STT from a genuine client-side context, or confirm the correct mechanism for reporting the real client IP on a server-mediated exchange before relying on this pattern anywhere real users' sessions are at stake.

Hardening Checklist

  • Scope every STT to the exact target audience/domain it was minted for.
  • Monitor and alert on failed silent-SSO checks that don't match the expected login_required pattern — that's a signal something is misconfigured or being probed.
  • Re-enable enforce_device_binding once the correct client-IP-reporting mechanism for server-mediated exchanges is confirmed — treat "none" as a temporary demo-reliability measure, not a resolved design decision.