jess-author

Jessica Temporal is a Senior Developer Advocate at Auth0 and co-founder of the first Brazilian data science podcast called <a target='_blank' href='https://pizzadedados.com'><strong>Pizza de Dados</strong></a>. She’s the author of <a target='_blank' href='https://www.amazon.com/dp/B0CDNX6NS7/ref=sr_1_1?&_encoding=UTF8&tag=jesstempora0e-20&linkCode=ur2&linkId=efc4229f6b816609dfce4f185781d99a&camp=1789&creative=9325' ><strong>The Big Git Microbook</strong></a>, creator of <a target='_blank' href='https://gitfichas.com/en'><strong>GitFichas.com</strong></a>, and a part of <a target='_blank' href='https://www.linkedin.com/learning/instructors/jessica-temporal'><strong>LinkedIn Learning</strong></a> instructors team. Jessica helped develop the AI that identifies possible unlawful expenses from Brazilian politicians. She is part of the PyLadies initiative that works to improve diversity and inclusion in technology. In her free time, she likes to knit, play video games, use her 3D printer, and is learning to create 3D models.

Sr. Developer Advocate

Jessica Temporal

Generative AI is everywhere, and since not every user has access to all data, learn how to use retrieval-augmented generation with fine-grained authorization to ensure that private information stays private.

Build Trustworthy AI: Implementing Access Control for RAG Systems Using FGA

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Staff Developer Advocate

Juan Cruz Martinez

Learn how to use the Auth0 Python SDK to query and store user data in this step-by-step tutorial.

The **Auth0 Dashboard** offers a wide range of tools for managing your application's authentication and authorization. You can create and delete users, assign roles, ban IPs, and much more. Although it's convenient to manage users directly from the dashboard, there may be scenarios where you need control from within your application.

Say, for example, that you want to store UI preferences such as dark/light mode settings or the user’s preferred theme directly on the user’s profile so that, independently from which device they connect to your application, they will have their favorite settings ready.

In scenarios like this, where your application directly processes and manages users' information, you can use the [Auth0 Management API](https://auth0.com/docs/api/management/v2), which allows you to work with users' data and programmatically access most features available in the Auth0 Dashboard.

In this article, we’ll explore how to use the Auth0 Management API from Python applications using the Auth0 Python SDK to read and store information about users, and at the end, we’ll build a lottery system to pull a random lucky user from the system.

## Accessing the Auth0 Management API

The Auth0 Management API allows you to programmatically create, access, update, and delete resources from your Auth0 tenant. It is an API built for back-end servers or trusted parties to perform administrative tasks such as user management or DevOps.

You can access the [Auth0 Management API](https://auth0.com/docs/api/management/v2) via HTTP requests directly or use one of the SDKs we provide for such a purpose. In any scenario, you’ll need a few things before starting the management API.

- **Auth0 account.** If you don’t have one already, you can <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>.
- **A machine-to-machine application**
- **A short-lived token** for production access to the API

### Set up your Auth0 account

Once you have an <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Auth0 account</a> you can navigate the the [Auth0 Dashboard](https://manage.auth0.com/#/applications) and access your applications list.

![Auth0 application's dashboard](https://images.ctfassets.net/23aumh6u8s0i/3QEFGVXK0EW2UlGNfaU8jK/bebbcfa41f716523f000c45b6ba863a0/auth0-ma-create-app.png)

Once on the page, click on the “Create Application” button on the top right and enter the following information:

- **Name**: A descriptive name for your application, e.g., User Management App
- **Application Type:** Because we’ll be connecting to this Auth0 application from another system, e.g., your Python application, you need to select “Machine to Machine Applications.”

Then click on “Create”.

![Creating a machine to machine application](https://images.ctfassets.net/23aumh6u8s0i/6F51sEhfGP6lOGXmldL8s7/c274315a617ae8f42c5278e61e91aa41/auth0-ma-create-app-details.png)

In the following dialog, you’ll select which API you’ll authorize this application to access. In our case, you’ll choose the **Auth0 Management API** already available in your tenant. Before authorizing the API, Auth0 will list all the permissions associated with it. There are many available. For our use case, you'll authorize the following: `read:users`, `update:users`, `read:users_app_metadata`, and `update:users_app_metadata`. Finally, click on “Authorize”.

![Assigning permissions to an API](https://images.ctfassets.net/23aumh6u8s0i/6eWpQ9QUTcOT9gT2gb5Do0/b4605872f7de2186401c747f044cd21e/auth0-ma-authorize-api.png)

> You can update your application’s permissions at any point from the Auth0 dashboard.

### Get a Test Token from the Auth0 Dashboard

Now you are ready to test your Auth0 Management API. Visit the API entry on the [Auth0 Dashboard](https://manage.auth0.com/#/apis).

![Auth0 API dashboard](https://images.ctfassets.net/23aumh6u8s0i/4ap0GxPP1WrjfaueqzfovG/150363bf27096f8bda6997aa5f49ced2/auth0-ma-apis.png)

Once there, click on the Auth0 Management API and head on to the “Test” tab. After a few seconds, you’ll see a screen like the following:

![Getting API Access Token from the Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/5HJDsh75FgjFB5fbfFhSLN/38ed227a790b4be7632ecaaa32c0af9e/auth0-ma-api-test.png)

Before continuing, ensure you have the correct application selected on the drop-down; next, you can copy your `access_token` from the UI. Make sure to copy just the value without the quotes. You’ll need this token next.

You can test your API directly on the [API documentation page](https://auth0.com/docs/api/management/v2). You can explore and test all the API endpoints there, though we’ll focus on the list [user’s endpoint](https://auth0.com/docs/api/management/v2#!/Users/get_users) for now.

![Auth0 Management API docs](https://images.ctfassets.net/23aumh6u8s0i/6tZBiNtrWUf8fmGeji8FUS/112e38d8ae05bf8376b402b9ccc04699/auth0-ma-list-users.png)

On the “List or Search Users” section, you’ll find the different parameters you can use to query users. For now, we’ll leave them all to the default values, and if you look to the right of the screen, you’ll find a button, “Test Endpoint”, at the end of the section.

The button is currently disabled as the documentation page is not authorized to make calls to the management API yet. To test endpoints on the documentation page, you'll need to provide an API Token using the "Set API Token" on the top right of the screen.

![Set API Token to make API calls](https://images.ctfassets.net/23aumh6u8s0i/6UO3HenV2TLVG6xTjVVFsF/24eaa6acff4b6728849588e434f7a202/auth0-ma-set-api-token.png)

Next, paste your access token from the Auth0 dashboard into the modal window and click “Set Token”. If you copied the token value correctly and tried the endpoint again, you should now see your list of users.

![Example response for the list users API endpoint](https://images.ctfassets.net/23aumh6u8s0i/5fse9EYIe0xXci2oPtxDXU/2980f08b1cdca89640fc4a0e6f787fa1/auth0-ma-list-users-list.png)

## How to Consume the Auth0 Management API with Python

To make your life easier when working with the Auth0 Management API, Auth0 offers a set of tools in multiple programming languages. In the case of Python, we have the [Auth0 Python SDK](https://github.com/auth0/auth0-python) that allows for easy and convenient access to all the features in the management API.

To consume the Auth0 Management API with Python, we will use the Auth0 Python SDK. To install it, run the following command:

```bash
pip install auth0-python
```

After installing the library, you must get a short-lived access token and initialize it programmatically. You’ll need information about your Auth0 tenant domain and the machine-to-machine application you created before. You’ll need the “Client Id” and the “Client Secret”, which can be found on the [Auth0 Dashboard](https://manage.auth0.com/#/applications) under your application’s settings.

![Domain, Client Id, and Client Secret are available in the app settings](https://images.ctfassets.net/23aumh6u8s0i/72vTRKfXxiFPXNIxTAGZkb/9be57cda028c928c9091d00c638c2d00/auth0-ma-app-settings.png)

Once you can access these values, you set the Auth0 SDK with the following code:

```python
from auth0.authentication import GetToken
from auth0.management import Auth0

domain = 'mydomain.auth0.com'
client_id = 'myclientid'
client_secret = 'myclientsecret'

get_token = GetToken(domain, client_id, client_secret=client_secret)
token = get_token.client_credentials('https://{}/api/v2/'.format(domain))
mgmt_api_token = token['access_token']
auth0 = Auth0(domain, token['access_token'])

auth0 = Auth0(domain, mgmt_api_token)
```

And finally, if you, for example, want to list your users, you can run:

```python
users = auth0.users.list()
print(users)

# Example Output
{
    "start": 0,
    "limit": 25,
    "length": 25,
    "users": [
        {
            "created_at": "2023-07-14T11: 01: 09.493Z",
            "email": "###.#####@###.com",
            "email_verified": False,
            "identities": [
                {
                    "connection": "Username-Password-Authentication",
                    "provider": "auth0",
                    "user_id": "64b12af5c157759fdf791d4d",
                    "isSocial": False
                }
            ],
            "name": "###.#####@###.com",
            "nickname": "###.#####",
            "picture": "https: //s.gravatar.com/avatar/.........png",
            "updated_at": "2023-07-14T11:01:09.493Z",
            "user_id": "auth0|64b12af5c157759fdf791d4d",
            "last_login": "2023-07-14T11:01:09.491Z",
            "last_ip": "2a01:c23:c480:7900:6c:a31c:9c46:f435",
            "logins_count": 1
        },
        ...
    ],
    "total": 40
}
```

## Updating Users’ Profile Information

Auth0's user profiles store basic information about each user, including a unique identifier, name, contact details, and identifying information such as their profile picture. This information is helpful during the authentication process, but you may also require additional information as the user logs in, such as:

- User preferences, such as the application’s theme or color scheme, etc.
- Flags that the user opt-in in the application, such as notification preferences, getting started tutorial completion, etc.
- Others, such as the last read announcement, subscription status, and more.

Auth0's user profiles can store such information as metadata, which your app can access once the user logs in successfully. Although your app could store this information in its own storage system, utilizing Auth0's user profile metadata offers the advantage of immediate availability during and after the login process.

A significant benefit of using metadata is that it is associated with the user's account rather than tied to a specific device. This ensures that if a user switches between the mobile and web versions of your app, their settings and preferences based on metadata will remain consistent across both versions.

Auth0 supports two types of users’ metadata:

- **User metadata:** refers to information the user can see and update, such as user preferences and settings
- **App metadata:** refers to information about the user that is only accessible by the application, for example, feature flags, last read announcement, and more.

Let’s now write a Python script to update the user’s name and metadata to store their preferred theme and an application flag enabling extra features on the user’s account.

```python
# As we did before, we need to get an instance of the Auth0 client
from auth0.authentication import GetToken
from auth0.management import Auth0

domain = 'mydomain.auth0.com'
client_id = 'myclientid'
client_secret = 'myclientsecret'

get_token = GetToken(domain, client_id, client_secret=client_secret)
token = get_token.client_credentials('https://{}/api/v2/'.format(domain))
mgmt_api_token = token['access_token']
auth0 = Auth0(domain, token['access_token'])

auth0 = Auth0(domain, mgmt_api_token)

# Next, we can proceed to update the user's name using the user's id
user_id = '{YOUR_USER_ID}'
auth0.users.update(user_id, {
    'name': 'My name is...'
})

# We can also update the user's metadata
auth0.users.update(user_id, {
    'user_metadata': {
    'theme': 'light'
  },
  'app_metadata': {
    'experimental_features': True
  }
})

# Let's add some more information to see what the end result is
auth0.users.update(user_id, {
    'user_metadata': {
    'font_size': '16px'
  },
  'app_metadata': {
    'notifications': False
  }
})

# Query the user information
user_info = auth0.users.get(user_id)
print(user_info)

# Output
{
    "created_at": "2023-07-14T09:22:19.151Z",
    "email": "###.#####@###.com",
    "email_verified": False,
    "identities": [
        {
            "connection": "Username-Password-Authentication",
            "user_id": "64b113cb6a989b51063087ce",
            "provider": "auth0",
            "isSocial": False
        }
    ],
    "name": "My name is...",
    "nickname": "###.#####",
    "picture": "https://s.gravatar.com/avatar/...",
    "updated_at": "2023-07-14T11:29:53.139Z",
    "user_id": "auth0|64b113cb6a989b51063087ce",
    "user_metadata": {
        "theme": "light",
        "font_size": "16px"
    },
    "app_metadata": {
        "experimental_features": True,
        "notifications": False
    }
}
```

Note that when calling the `update` method, we don’t need to send all the information about the user, but only those fields we would like to change. This makes working with data really simple, as we don’t need to worry about overriding critical fields. Even on the `user_metadata` and `app_metadata` fields, we don’t need to send the full JSON we want to store but rather the individual key-value pairs, Auth0 will automatically merge the existing values with the new ones.

We can also access the user information from the [user’s entry in the Auth0 Dashboard](https://manage.auth0.com/#/users).

![Viewing user's profile and metadata information in the Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/12wH1mxn2Od5hcOQ7SwOTG/d8f45e0725c7eaeeab916bf94a6b9723/auth0-ma-list-user-data.png)

## Query Users

Whether you are building a user dashboard, gathering some statistics, or needing your users’ information to process in your application, the Auth0 Management API and the Auth0 Python SDK allow you to access the information you need and how you need it.

Previously we used the method `users.list` to retrieve a list of all users in the Auth0 database, which may be all that you need. However, that method offers advanced query functions worth knowing and exploring.

First, let’s start with paginating results. By default, paging is disabled. However, you can quickly specify the page and the number of items per page you want to retrieve with these two parameters:

- **page**: Page index of the results to return. The first page is 0.
- **per_page**: Number of results per page.

Here is an example querying the second page of users, up to ten users per page

```python
users = auth0.users.list(page=1, per_page=10)
```

Another common parameter in usage is sorting operations. For this purpose, the SDK exposes the `sort` parameter to specify the field and direction. For example:

```python
users = auth0.users.list(sort="name:1")
```

Use `field:order` where the order is `1` for ascending and `-1` for descending.

Lastly, one of the most powerful functions is the ability to perform complex queries, for example, getting all the users whose names start with `J` or even filtering by custom metadata, listing all the users that prefer the dark mode theme. Auth0 uses [Lucene query string syntax](http://www.lucenetutorial.com/lucene-query-syntax.html) for those complex queries, though there are some limitations, as some query types cannot be used on metadata fields, for details see [Searchable Fields](https://auth0.com/docs/users/search/v3/query-syntax#searchable-fields).

Example 1: List all users whose name starts with `J`

```python
users = auth0.users.list(search_engine='v3', q='name:j*')
```

Example 2: List all users that prefer dark mode

```python
users = auth0.users.list(search_engine='v3', q='user_metadata.theme:dark')
```

You can also mix multiple search criteria, for example:

```python
users = auth0.users.list(search_engine='v3', q='name=j* AND user_metadata.theme:dark')
```

To learn more about how to form queries, check the [Lucene query string syntax](http://www.lucenetutorial.com/lucene-query-syntax.html).

## Selecting a Random User

For the events we attended this year, we created a fun game using Python, Flask, and Auth0 to give some fabulous prizes away to lucky contestants. The game was pretty simple. It consisted of people signing up for our application at events like PyCon. During the day, users registered to the game using the Auth0 Universal Login page. Then, when it was time to give prizes away, we would use the same Flask application to withdraw a lucky winner. The winner would then get a special award from Auth0.

To select the lucky winner, we built a special page using the `users.list` method. There was a caveat: the same user couldn’t win twice. The way we solved it was by using `app_metadata` to store information about the users who had already won and then using Lucene syntax to filter them out when pulling for a new winner.

Though not critical for our situation, we wanted the script to be efficient and thus not pull the whole user’s database, as it could be quite extensive, so instead, we first pulled the API to know how many users were in total with a minimum query, and then we accessed a random user from the pull and extracted only that user’s information.

```python
import random

# List only 1 user just to retrieve the total number of users that match the given query
user_count = auth0.users.list(per_page=1, include_fields=False, search_engine='v3', q='NOT app_metadata.winner:true')["total"]

# Then, use the same trick of listing one user per page to get a random page between 0 and the total number of users
# That resulting user is our lucky winner
winner_user = auth0.users.list(page=random.randint(0, user_count - 1), per_page=1, include_fields=False, search_engine='v3', q='NOT app_metadata.winner:true')['users'][0]

# Before we do anything else with the results, update the user's metadata to reflect them as winner
auth0.users.update(winner_user.get('user_id'), {
    "app_metadata": {
        "winner": True
    }
})
```

## Summary

Today you learned about the Auth0 Management API and how to work with it from the documentation as well as from any Python application. You also learned how to work with user information, user, and app metadata, and how to query users from the Auth0 database using simple and more complex queries.

Thanks for reading!

Use the Auth0 Python SDK for Querying and Storing Users’ Data

Damian Schenkelman

Damian was one of Auth0's earliest employees. He loves building products for developers and taking things from 0 to 1.
<br><br>
He played key roles in implementing product features and growing the engineering organization in the early stages, and later on defining Auth0's architecture for scale and creating new products. Today he helps shape Auth0's long term strategy and leads Auth0Lab, a small and amazing team doing research and development of forward-looking products.
<br><br>
He spends his spare time with family, and friends, exercising, and catching up on all things NBA.

VP R&D (Auth0Lab)

How to issue Verifiable Credentials from Auth0 user data using MATTR's Auth0 Marketplace Integration

Verifiable Credentials with Auth0 and MATTR

1Vitor de Sousa_Auth0

As Regional Vice President, Vitor de Sousa supports Okta and Auth0's German customers in achieving their Identity and Access Management goals. With more than 20 years of experience in the consumer goods industry, as well as in technology and software sales, he develops strategically smart and creative solutions for the interplay of identity authentication, customer experience, and data protection.

Regional Vice President, Enterprise Sales - Germany

Vitor de Sousa

Companies in the DACH region use Auth0 to streamline their login flows and consolidate their user data

Customers expect a great user experience (UX) from their web apps. They also expect the companies behind those apps to keep their personal data private and secure. The challenge for businesses in this environment is how to create a low-friction customer experience (CX) while seamlessly integrating the necessary security features, privacy features, and data flows. Data from [Auth0’s global survey](https://info.auth0.com/erwartungen-und-realitat.html), including more than 2,000 consumers and 200 IT/marketing decision-makers in Germany, shows that in the DACH region, there are some mismatches between these two forces.

Nearly one-third of German consumers (31%) are more likely to sign up if an app offers biometric authentication. Yet a mere 17% of German businesses offer it. Similarly, 40% of German consumers are more likely to sign up if they can use Multi-factor Authentication (MFA), but only one in four businesses (27%) offer that security feature. These consumers also cited lengthy login and sign-up forms (42%) and entering personal information (38%) as their top frustrations with the sign-up process for new applications.

The question companies in Germany, Austria, and Switzerland need to answer is, “how do we address these mismatches when designing customer-facing web applications?” We’ve been looking at various ways Auth0 can assist in this process with our series on customer identity and access management (CIAM) in Central Europe. We’ve looked at how a robust CIAM solution can help bridge the gap between legacy and cloud-native infrastructure, as well as how organizations can have options to support their data residency needs when partnering with an identity as a service (IDaaS) provider. In this post, we’re going to discuss how three particular businesses are doing all of that, and more, with the help of Auth0.

- [Bridging Legacy Systems and Digital Transformation with CIAM](https://auth0.com/blog/bridging-legacy-systems-and-digital-transformation-with-ciam)
- [Centralize Identity For Security and Customer Experience](https://auth0.com/blog/centralize-identity-for-security-and-customer-experience)

## Using Auth0 to Bridge the Legacy-cloud Gap

According to a [recent study by McKinsey](https://www.mckinsey.com/business-functions/strategy-and-corporate-finance/our-insights/how-covid-19-has-pushed-companies-over-the-technology-tipping-point-and-transformed-business-forever), the COVID-19 pandemic accelerated the digitization of customer interactions by three years for companies in Europe. The same study found an impressive seven-year acceleration when it asked about services being digitized. While this trend started before the COVID-19 pandemic, that global event certainly sped things up for many organizations. What many are discovering is that it can be complicated to develop a single CIAM tool that can connect customers to both legacy on-prem systems and those they have already migrated to the cloud.

Auth0’s extensibility, along with the ease of integration provided by [Auth0 Marketplace](https://marketplace.auth0.com/) and low-code [Actions](https://auth0.com/actions), simplifies the process of closing this gap. Rather than developing in-house identity solutions that only work on a single asset, which leads to siloed customer data and authentication systems that are difficult to maintain, Auth0 gives you a single intuitive login box that’s connected to whatever systems a customer is supposed to have access to. And you get a single source of truth (SSoT) for your customer data, aiding in regulatory compliance as it simplifies your access to that data.

## Offloading IDaaS While Maintaining Control Over Your Data

The second challenge is easier to address when you have that SSoT for your customer data in place. By bringing all of your properties under one CIAM solution, you’re able to store all user data in a single database. And in the case of Auth0 in DACH, that database can be located in an AWS facility in Frankfurt for public cloud options, and we also offer [private cloud deployments on Microsoft Azure](https://auth0.com/blog/auth0-on-microsoft-azure-as-a-private-cloud-deployment-option/) and AWS infrastructure. Multiple cloud deployment options, along with our [expertise in privacy regulations](https://auth0.com/docs/compliance/gdpr) in the region, mean you have a greater set of tools at your fingertips, giving you choices about where and how your data is stored. 

CIAM is a need that crosses industry verticals and markets, so we’re going to look at three organizations that span the business world in the DACH region: energy provider Energie Baden-Wurttemberg (EnBW), infrastructure leader Siemens, and travel platform HolidayCheck.

## EnBW: Expanding Their Reach While Staying Close to Their Customers

Energie Baden-Wurttemberg, or [EnBW](https://auth0.com/blog/enbw-uses-auth0-to-improve-its-customer-experience/), is one of the largest energy companies in Germany and in Europe, serving millions of customers daily. Their menu of services includes gas, water, electricity, and a growing number of ancillary services. They’re experiencing solid growth and found themselves needing to consolidate identity for both their business and private customers.

EnBW needed to streamline their login process by consolidating decentralized login interfaces and ensuring their customers understood everything they were doing to ensure the security and privacy of that data. All while providing a seamless user experience across platforms. Auth0 [extensibility](https://auth0.com/extensibility) and [integrations](https://auth0.com/docs/integrations) allowed them to create a single, unified login experience whether the customer was a business or individual homeowner, and regardless of whether they needed to pay a gas bill or ask a question about their water service. As they looked at their expansion plans, the digitization team at EnBW saw the need for an identity solution that would help them move closer to their customers while they continued to grow their service offerings.

<include src="QuoteCard" body="Digital transformation is more than just an isolated project or the development of an app. Rather, it is a matter of laying a long-term technical foundation for improving proximity to the customer. By using the Auth0 solution, we are able to do just that. This enables us to offer a consistent customer experience across all digital services..." name="Florian Riedl" title="Head of Digitisation" team="" company="EnBW" />

Local data storage options was one consideration for EnBW when they built their strategy for maintaining proximity to their customers. Auth0’s certifications and regulatory expertise, along with the ability to store data locally at an AWS data center in Frankfurt, provide EnBW with verification to show their customers while ensuring the company has easy access to downloading their own data for their compliance audit requirements.

## Siemens ID: Powered by Auth0

As part of their recent pivot to adopting a more sustainable growth model, international infrastructure and manufacturing automation leader [Siemens](https://auth0.com/case-studies/siemens/) understood they were going to need an identity solution that could scale with them. With a history going back over 170 years, they already had an extensive ecosystem of back-office systems, front-end services, and web applications that all needed to be consolidated under a new identity platform. 

Prior to their pivot, Siemens was applying internal policies to external accounts. This set-up caused confusion on the part of partners and customers, was prone to breaking down and led to problems related to [broken authentication](https://auth0.com/blog/what-is-broken-authentication/). The goal for their identity project was to create a uniform login experience for their customers and partners with a single IDaaS solution. Bringing everyone under one log-in system would allow Siemens better control over who had access to what data and put an end to their authentication problems.

For help, Siemens turned to Auth0. They were drawn in by our extensibility, customizability, and centralized control over their [multi-tenant](https://auth0.com/blog/using-auth0-for-b2b-multi-and-single-tenant-saas-solutions/) setup. The latter means that each division within Siemens retains control over the customer experience for their product, yet all user data ends up in the same centralized data store. This ability helped sell the project when it came time to get buy-in from new product teams. 

<include src="QuoteCard" body="When Auth0 stepped in, we could improve the processes around identity management, reducing efforts while increasing the acceptance of the internal stakeholders." name="Hugo Francisco" title="Service Owner" team="Siemens ID" company="" />

## HolidayCheck Uses Auth0 to Increase User Trust

Providing trustworthy reviews (9 million and counting) of hotels and other destinations to their user base of 13+ million monthly visitors is what [HolidayCheck](https://auth0.com/case-studies/holidaycheck/) is all about. They also host over 10 million holiday pictures submitted by their dedicated users. And all of this user-generated content (UGC) needs to be available regardless of the platform the customer uses, whether a smartphone, tablet or laptop. With so much UGC, HolidayCheck knows that trust is a key component of their success.

This is why HolidayCheck partnered with Auth0 to develop an IDaaS solution that would engender trust in those users. Trust that a review or photo is from who it claims to be from and that those users are who they say they are. That trust needed to extend to the value HolidayCheck puts on their users and have the privacy of their data top of mind at all times. The security of their UGC is of paramount importance to HolidayCheck, and Auth0’s deep knowledge of regulations that are important to customers in the DACH region was another reassuring factor for their decision-makers.

<include src="QuoteCard" body="I think this is what we at HolidayCheck stand for: to provide the best information so that you don't get any bad surprises. Knowing that a real, verified person is behind the content is a big benefit." name="Bjorn Zadadlo" title="Director of Technology" team="" company="HolidayCheck" />

Prior to partnering with Auth0, HolidayCheck used an in-house identity solution. They soon understood how resource-intensive maintenance and support had become, along with how low the ROI on those expenses was. This led them to search out a secure, private IDaaS solution that would deliver the same great CX their customers had come to expect. 

<include src="QuoteCard" body="If authentication works well and reliably and becomes very low friction for the user, that just means to the user that you're building a well-working website. It's important that users can also trust you with providing their data. That's what you're doing with login or identity management: you're providing data to a company, and you usually don't do that if you don't trust them." name="Stefan Lau" title="Software Developer" team="" company="HolidayCheck" />

The partnership with Auth0 brought them the right combination of these features while allowing their expert development teams to focus on delighting their customers with new site-wide features while we handled the authentication service, support, and maintenance.

## Organizations Across the DACH Region Trust Auth0 With Their Identity Needs

Maybe you’re expanding your portfolio of web applications and need an identity solution that can bridge the gap between legacy and modern cloud-based infrastructure while you iterate a migration strategy. Or perhaps you’re looking to centralize your identity management with a single log-in box that connects your diverse user base to whichever property they need while keeping your customer data private and secure. Whatever your situation, Auth0 can help. [Reach out to our DACH team](https://auth0.com/contact-us) to learn more about how you can put our expertise to work serving your customers today.


Unified Login Flows and Data Location Choices in DACH

Partnering with a provider to centralize identity lets you maintain control over your data without compromising user experience

Consumers expect the web apps and services they use to be intuitive while also requiring secure and private transactions and a low-friction experience. A good example of this is the increasing demand for biometrics, the use of a person’s physical attributes like a fingerprint or face scan to prove identity and control access. Consumers have become accustomed to the security and convenience that using a fingerprint to unlock their smartphone offers, so using the same technology to secure your web app is an intuitive way to help secure their account data.

[Auth0’s recent global survey](https://info.auth0.com/erwartungen-und-realitat.html), including more than 2,000 consumers and 200 IT/marketing decision-makers in Germany, found that 31% of German consumers are more likely to sign up for a service if it offers biometric authentication. Yet only 17% of German businesses offer this feature. SO biometric authentication is one way for businesses in the DACH region to better align themselves with their customers’ expectations for security without compromising their customer experience (CX). 

Partnering with an [Identity as a Service (IDaaS)](https://auth0.com/blog/what-is-idaas/) provider who understands how to combine an intuitive user interface with strong security measures like that offered by biometrics can bring additional benefits to your organization. For example: freeing your in-house development talent to focus on your core product, helping you meet regional data privacy regulations, and maintaining active control over your user data.

## Let Your Internal Talent Focus on Your Core Product

Germany is not only the largest economy in the EU; it is also home to the largest software developer talent pool in the region. [As of 2019](https://www.cbi.eu/market-information/outsourcing-itobpo/software-development-services/market-potential), there were more than 900,000 developers in the country, with a majority describing themselves as [Full-Stack front-end developers](https://insights.stackoverflow.com/survey/2021). To ensure your in-house dev teams can focus on those strengths, don’t distract them with an identity project. At Auth0, identity is our core product. Our teams built, maintained, and enhanced a Customer Identity and Access Management (CIAM) platform that incorporates industry security standards, an expert understanding of regional data privacy regulations, and a highly customizable set of integrations to bring you exactly the right mix of security, privacy, and CX.

Our identity specialists bring their expertise and knowledge to secure your authentication and authorization processes while also bringing your customers the tailored, low-friction CX they expect. That allows us to help you build a solution that will be capable of incorporating your needs in the present — while remaining extensible enough to scale with your plans for the future. 

The centralized identity solution you build will unify authentication for your platforms, services, and web apps. This single source of truth (SSoT) for your customer identity data is easier to secure than disparate, siloed data stores for each system. It also limits your attack surface by eliminating multiple access points and login boxes. 

By partnering with Auth0, you get a centralized identity platform that’s ready to be customized by your developers to meet your precise requirements. And our extensibility allows that platform to be readily extended to cover all of your existing properties, whether they’re modern cloud-based apps or legacy on-prem systems.

## Understanding Data Privacy Regulations in The DACH Region

EU Member States are allowed to enact national privacy rules to supplement, specify, and modify the GDPR rules as applied to their citizens. It’s important that companies familiarise themselves with these rules that often govern specific situations.

This document is not intended to act as legal advice. Please consult your legal counsel to ensure you are in compliance with all applicable data privacy laws and regulations.

The right to privacy is well established and respected in the DACH region, where such legislation existed long before the GDPR. Today there are additional rules such as the new German Privacy Act (BDSG-new) along with industry-specific regulations for, e.g., telecommunications, banking, and energy. In Austria, too, we see local regulations like the [Federal Act on the Protection of Individuals With Regard to the Processing of Personal Data (DSG)](https://www.dataguidance.com/notes/austria-data-protection-overview), all designed to put the privacy rights of citizens first.

[Switzerland](https://www.dataguidance.com/notes/switzerland-data-protection-overview) has a slightly different take on data protection regulations as well. In addition to GDPR, there are two additional laws that impact data collection and processing there. The first is Article 13 of the Swiss Constitution, which protects Swiss citizens’ rights to privacy in personal and family life, as well as within the home. Meanwhile, the Federal Act on Data Protection (FADP) solidified the language governing how those rights are protected in regards to digital data. Unless you have a team of lawyers and governance specialists for your developers to work with, making sure you’re in full compliance with all of these regulations will soak up a lot of internal resources. Partnering with an IDaaS provider can alleviate these additional strains by taking on the task of helping to assure compliance.

The DACH data privacy landscape can seem complex, and the responsibility for coding privacy into your applications often falls to the people building them. By partnering with Auth0, your developers can help you protect your customer’s personal information without becoming privacy experts themselves. Auth0’s key privacy-enabling features include:

* Easy access to user profiles to enable removal requests
* To export a user’s data in JSON format for data portability
* To enable Log Streaming for continuous security monitoring
* The knowledge that your data is stored locally at an AWS facility in Frankfurt

## Great Customer Experience Includes Choices for Data Location

Part of ensuring your customers get the experience they expect is maintaining control over the data they share when they create an account. Consolidating that data into an SSoT simplifies continuously monitoring its security and detecting threats and other anomalies. Having choices with respect to the location where your data is stored is another asset of partnering with an IDaaS provider like Auth0.

### Data security certification

Auth0 brings knowledge of [regional privacy regulations](https://auth0.com/docs/compliance/gdpr), along with internationally recognized certifications from organizations such as the International Standards Organization (ISO) [27001](https://www.iso.org/obp/ui/#iso:std:iso-iec:27001:ed-2:v1:en) and [27018](https://www.iso.org/standard/61498.html), along with a[ SOC 2 Type II audit](https://auth0.com/blog/auth0-achieves-soc-2-certification/). These are third-party verified certifications, meaning a specialized auditing body has signed off on the security of our processes, infrastructure, [platform](https://assets.ctfassets.net/kbkgmx9upatd/2KxmM5BICQ4GKgeIwA0sKu/d4f59bd579803593edcd571f1aa92ef0/Auth0_Platform_Operations.pdf), policies, and continuous monitoring framework. Auth0 complies with [additional regulations](https://auth0.com/de/security) as well, BaFin, EBA, and HIPAA for example. 

### Customizable user interfaces

[Auth0 Marketplace](https://marketplace.auth0.com/) offers integrations with major line-of-business software, while our [Actions](https://auth0.com/actions) capability allows your developers to work with these integrations with everything from drag and drop to a full Javascript editor. This ease of integration and customization means you can create your login box once and use it across properties.

### All your user data in one place

Being cloud-native gives Auth0 the flexibility to offer multiple data storage options. Access is a key piece of data residency. For organizations in the DACH region, we offer [private cloud deployment options on Microsoft Azure](https://auth0.com/blog/auth0-on-microsoft-azure-as-a-private-cloud-deployment-option/) or AWS infrastructure, as well as public cloud options using an AWS facility in multiple regions such as Frankfurt to help our customers achieve compliance. 

### Iterative deployment to ensure buy-in across the organization

Deploying a new identity and access management system can be a lengthy and complex process from a business perspective. Partnering with Auth0 and taking advantage of our identity experts allows for an iterative deployment and a smooth migration that does not jeopardize the user experience by offering frictionless user migrations without password resets. That way, each department or product team can witness a successful roll-out before giving their buy-in without straining your in-house talent. Cross-departmental collaboration is key to any software project, particularly when that software controls data access, and having a successful proof-of-concept (POC) in hand can help secure buy-in as you move forward.

Work with an identity partner that understands your need for a great digital experience without compromising the security and privacy of your customer data. [Reach out to our identity experts](https://auth0.com/contact-us) when you’re ready to continue the conversation or to find out how to start working with Auth0 today.


Centralize Identity For Security and Customer Experience

manfred

Under the leadership of Manfred Steyer, ANGULARarchitects.io supports companies with the implementation of web-based business applications with Angular. <br>
 
At the Angular seminars he designs, he combined his profound knowledge of Angular, for which he was recognized by Google as a Google Development Expert (GDE), with his experience, which he worked as a team leader in the field of software development, as a Professor at a university of applied sciences and as an external member of the Angular team. <br>
 
Manfred has published books at O'Reilly, Microsoft Press, and Hanser and writes for Heise Online, windows.developer, and the Java magazine. He also regularly shares his knowledge at conferences.

Trainer and Consultant with focus on Angular

Manfred Steyer

Module Federation allows loading Micro Frontends at runtime. Common dependencies like Angular or the Auth0 library can be shared and hence don't need to be loaded several times. This is also the key for sharing data like the current user or global filters.

**TL;DR:** Module Federation allows loading Micro Frontends at runtime. Common dependencies like Angular or the Auth0 library can be shared and hence don't need to be loaded several times. This is also the key for sharing data like the current user or global filters.

## Micro Frontends

Recently, there have been a lot of discussions about Micro Frontends. The underlying idea is quite tempting: Splitting a huge software system into smaller parts and assigning each part to an individual team:

![Each micro frontend can be developed by an autarkic team](https://images.ctfassets.net/23aumh6u8s0i/38DpehwkPwiMTNBOvOQowG/ce345e71277e19f211f23add38a0ae4e/microfrontends.png)

As these teams are -- more or less -- autonomous, they can work in a more flexible way and don't need to coordinate that much with others. This shows that Micro Frontends are mostly about scaling teams. Hence, if you don't have several frontend teams, Micro Frontends might be overkill. 

## Module Federation

Splitting software systems into several parts is, however, only one side of the coin. Even though we developers might like this idea, the users don't! They aren't interested in starting several frontends but expect an integrated solution. 

Accordingly, we need to find a way to make all our micro frontends appear as one (single page) application. Very often, this involves loading micro frontends into a shell application.

For instance, the example used here mimics a simple shopping system. One of its micro frontends deals with shipping:

![Example micro frontend dealing with shipping products](https://images.ctfassets.net/23aumh6u8s0i/3Zs0it0naO2U4W1GwBMpNn/caa76eb2a246ab2dfa5d5394c6ed89c5/example-shipping.png)

For the purpose of integration, this micro frontend needs to be loaded into a shell:

![Example of a shell loading the shipping micro frontend](https://images.ctfassets.net/23aumh6u8s0i/iJOA5Lg4AHYGHBt0SK06U/8bdb25c11b8ac571f259f57217ff72eb/example-shipping-in-shell.png)

The shell loads this but also other micro frontends on demand.

For such an implementation, you needed a lot of tricks in the past. Fortunately, Module Federation makes this task straightforward. 

Module Federation is an integrated part of webpack 5, and hence, it works with all modern web frameworks. Also, as webpack is highly used in nearly all communities, Module Federation immediately becomes a widespread solution.

In order to allow loading separately compiled and deployed micro frontends, Module Federation defines two roles: the host and the remote:

![Schematic representation of Module Federation](https://images.ctfassets.net/23aumh6u8s0i/6RTBbIScEwfnZm97MMe7nJ/2138d86c99a988b286f9852d020097a4/module-federation.png)

In our case, the host is the shell, while the remote is the micro frontend. Both can be configured with their webpack configurations. 

The host defines virtual URLs pointing to remotes. In the previous picture, for instance, the URL ``mfe1`` pointing to a micro frontend, also called ``mfe1``, is defined.

The remote, in turn, exposes files -- or, to be more precise: EcmaScript modules -- for the host. To prevent that, the latter one needs to know the remote's file structure; exposed files can get a shorter alias. The example in the last picture goes with the alias ``Cmp``. 

Exposed EcmaScript modules can easily be loaded into the host by using a dynamic ``import`` together with the mapped URLs and defined aliases. The best: From Angular's perspective, this is just like lazy loading. 

As Angular doesn't even recognize that the application loads a micro frontend, we can use it exactly as it was intended to be used. We don't need any tricks or meta frameworks orchestrating different SPAs in our browser window. This eases our endeavor dramatically.

## Module Federation in Angular

Since version 12, the Angular CLI uses webpack 5. Hence, we also get Module Federation out of the box. To activate it, we need a custom builder that, e. g. ships with the community solution ``@angular-architects/module-federation``. As it comes with respective schematics, you can easily ``ng add`` it to your CLI workspace:

```bash
ng add @angular-architects/module-federation
```

![Adding @angular-architects/module-federation to your project](https://images.ctfassets.net/23aumh6u8s0i/3eoqQDVCE5OK0QfzoYmXt8/378fda04d26bd28ffc798754f3150819/ng-add.png)

The well-known CLI extension [Nx](https://nx.dev/) is supported too. The schematic asks about the name of the project in your workspace you want to enable module federation for. Also, it asks which port to assign for ``ng serve``.

After that, it generates several files, e. g. a partial webpack configuration we need to adjust for our needs. Also, it registers the custom builder in our ``angular.json``.

For the example used here, I ran this command twice: Once for the shell and once for the above-shown shipping micro frontend. The latter one is just called ``mfe1`` here.

## Configuring the Micro Frontends

Now, we need to adjust the webpack configurations generated for the shell and the micro frontend. As the Angular CLI is generating most parts of the webpack configuration, we just need to define the remaining details for the module federation. First and foremost, this is about configuring the ``ModuleFederationPlugin`` that ships with webpack.

Let's start with the configuration for the micro frontend:

```javascript
// projects/mfe1/webpack.config.js

[...]
plugins: [

  new ModuleFederationPlugin({
    
      // For remotes (please adjust)
      name: "mfe1",
      filename: "remoteEntry.js",
      exposes: {
          './AddressModule': './projects/mfe1/src/app/address/address.module.ts',
      },        
      
      shared: share({
        "@angular/core": { singleton: true, strictVersion: true, requiredVersion: 'auto' }, 
        "@angular/common": { singleton: true, strictVersion: true, requiredVersion: 'auto' }, 
        "@angular/common/http": { singleton: true, strictVersion: true, requiredVersion: 'auto' }, 
        "@angular/router": { singleton: true, strictVersion: true, requiredVersion: 'auto' },
        "@angular/material": { singleton: true, strictVersion: true, requiredVersion: 'auto', includeSecondaries: true },

        ...sharedMappings.getDescriptors()
      })
          
  }),
],
[...]
```

The property ``name`` is normally the project name and should be unique across all micro frontends. The ``filename`` points to a file webpack generates when building the project. It's often referred to as the remote entry point. This JavaScript file provides all the metadata the shell needs to know for loading the micro frontend.

While normally you can go with the generated values for ``name`` and ``filename``, you very likely need to adjust the ``exposes`` section. As discussed above, it contains the aliases for the files to expose.

With ``shared``, you define all the npm packages you want to share across the shell and the micro frontends. These packages are only loaded once at runtime. This is vital because having ten micro frontends doesn't mean you want to load Angular or other packages ten times!

Of course, when sharing packages at runtime, we might end up with version conflicts. Fortunately, Module Federation also got us covered here: It provides several strategies for dealing with version mismatches. 

In our case, the combination of ``singleton: true`` and ``strictVersion: true`` is used. Hence, only one version of the shared packages is allowed, and if Module Federation detects several versions at runtime, it throws an Error. While this seems to be quite harsh at first sight, it allows our integration tests to immediately find out about version mismatches.

More details on [strategies for preventing version mismatches](https://www.angulararchitects.io/en/aktuelles/getting-out-of-version-mismatch-hell-with-module-federation/) can be found [here](https://www.angulararchitects.io/en/aktuelles/getting-out-of-version-mismatch-hell-with-module-federation/).

Besides ``singleton`` and ``strictVersions``, there are two further properties used: ``requiredVersion`` and ``includeSecondaries``. If we set the first one to ``auto``, ``@angular-architects/module-federation`` assumes the version found in your project's ``package.json``. This avoids several [pitfalls](https://www.angulararchitects.io/aktuelles/pitfalls-with-module-federation-and-angular/). 

The option ``includeSecondaries`` is provided by ``@angular-architects/module-federation`` too. It automatically adds all secondary entry points to the list of shared libraries. In the case of libraries like Angular Material, this saves you a lot of typing as they provide one such entry point per component, e. g. ``@angular/material/input`` or ``@angular/material/button``.

Now, let's have a look at the exposed ``AddressModule``: 

```typescript
// projects/mfe1/src/app/address/address.module.ts

[...]

@NgModule({
  imports: [
    [...]
    RouterModule.forChild([{
      path: 'address', 
      component: AddressComponent
    }])  
  ],
  declarations: [
    AddressComponent
  ],
})
export class AddressModule { }
```

As you see, it's just an ordinary Angular module. However, as it has child routes, we can immediately route to them after loading the whole module into the shell. 

## Configuring the Shell

The shell's ``webpack.config.js`` is a bit simpler. Here, we only need to define the shared libraries:

```javascript
// projects/shell/webpack.config.js

[...]
plugins: [
  new ModuleFederationPlugin({

      shared: share({
        "@angular/core": { singleton: true, strictVersion: true, requiredVersion: 'auto' }, 
        "@angular/common": { singleton: true, strictVersion: true, requiredVersion: 'auto' }, 
        "@angular/common/http": { singleton: true, strictVersion: true, requiredVersion: 'auto' }, 
        "@angular/router": { singleton: true, strictVersion: true, requiredVersion: 'auto' },
        "@angular/material": { singleton: true, strictVersion: true, requiredVersion: 'auto', includeSecondaries: true }

        ...sharedMappings.getDescriptors()
      })
      
  }),
],
[...]
```

In addition, we also could map URLs here, as outlined above. This would look like this:

```typescript
// Alternative that maps URLs upfront
new ModuleFederationPlugin({
  remotes: {
    "mfe1": "mfe1@http://localhost:3000/remoteEntry.js"
  },
  [...]
})
```

The key is the mapped URL, and the value defines the name of the micro frontend as defined in its ``webpack.config.js``. Here, the value also contains the location of the micro frontend's remote entry point. To load ``mfe1``'s exposed Module, we could use a dynamic ``import``:

```typescript
// Using mapped URL:
import('mfe1/AddressModule')
```

As the TypeScript compiler doesn't know the file ``mfe1/Module``, we also needed a type definition. For this, we could create an arbitrary with the ending ``.d.ts``:

```typescript
declare module "mfe1/AddressModule";
```

However, while mapping URLs this way is simple, it also requires us to know about the micro frontends and their locations upfront. Hence, I'm using a more dynamic approach that does not demand us to define URLs for compile time. 

Instead, we can tell Module Federation about possible Micro Frontends at runtime. To make use of it, I use the helper function ``loadRemoteModule`` provided by ``@angular-architects/module-federation`` together with lazy routes:

```typescript
// projects/shell/src/app/app.module.ts

[...]
RouterModule.forRoot([
  {
    path: '',
    component: HomeComponent
  },
  {
    path: 'mfe1',
    loadChildren: () => loadRemoteModule({
      remoteEntry: 'http://localhost:3000/remoteEntry.js',
      remoteName: 'mfe1',
      exposedModule: './AddressModule',
    }).then(m => m.AddressModule)
  }
])
[...]
```

The ``loadRemoteModule`` function takes the location of the remote entry point, the remote's name, and the alias of the exposed EcmaScript module. All these values are defined in the micro frontend's webpack configuration. 

As these properties are just strings, we could even retrieve their values from a configuration file or from a service endpoint.

## Trying It Out

After starting both projects, e. g. with ``ng serve shell, `` and ``ng serve mfe1``, we can use the lazy route shown above to load the micro frontend into the shell. It's also interesting to inspect the loaded files in your browser's dev tools:

![The browser loads the shared libraries](https://images.ctfassets.net/23aumh6u8s0i/5YzAFolOzvMYTspPsgZ5Wb/73d1fb9772e1128fca2eca404a1aa0ce/share.png)

At first sight, it really looks like lazy loading. However, when looking more closely, we see that the lazy chunks come from the micro frontend's origin. Also, for all the shared libraries, a bundle of its own is loaded. This is necessary because the module federation decides at runtime when to load which shared package. 

## Authentication for Micro Frontends

Sometimes we need to share some information between micro frontends and the shell, e. g. context information like the current user or global filters like the selected customer. The example used here allows logging in the user via the shell:

![Logging in the current user](https://images.ctfassets.net/23aumh6u8s0i/2XumqnUE2Cp56cB0nWJt2w/37480acbfca69c8036e36d38b94fbcd2/logged-in.png)

However, when loading the micro frontend on demand, it also knows about the current user:

![Sharing information about the logged in user](https://images.ctfassets.net/23aumh6u8s0i/2BdJ84YhuAxliC349B9A2Q/6294f33fd3d8b940789da984d41efe8c/logged-in-shipping.png)

To achieve this, we just need to share a package that holds the information to share. In our case, this is ``@auth0/auth0-angular`` as we are using Auth0 as our identity provider. It's available via npm:

```bash
npm i @auth0/auth0-angular
```

To make this work, I've configured a web application at https://manage.auth0.com/. If you want to try this out, don't forget to register your SPA's URL, e. g. http://localhost:4200, under _Allowed Callback URLs_. Besides this, I went with the default values proposed by the web portal.

To get started, we need to import the ``AuthModule`` provided by ``@auth0/auth0-angular`` into the ``shell``'s but also into ``mfe1``'s ``AppModule``:

```typescript
// projects/shell/src/app/app.module.ts
//  and
// projects/mfe1/src/app/app.module.ts

[...]

import { AuthModule } from '@auth0/auth0-angular';

[...]

@NgModule({
  imports: [
    AuthModule.forRoot({
      domain: 'dev-ha-6vf7s.us.auth0.com',
      clientId: 'pQXuZGn3bfOfHpFd9ch7Wfa4xP4KhKlS'
    }),
    [...]
  ],
  [...]
})
export class AppModule { }
```

The values for ``domain`` and ``clientId`` can be found at https://manage.auth0.com after registering your application.

After that, we can use the ``AuthService`` in the shell to login the current user:

```typescript
// projects/shell/src/app/home/home.component.ts

import { Component } from '@angular/core';
import { AuthService } from '@auth0/auth0-angular';

@Component({
  selector: 'app-home',
  templateUrl: './home.component.html',
  styleUrls: ['./home.component.scss']
})
export class HomeComponent {

  user$ = this.auth.user$;

  constructor(private auth: AuthService) {}

  login(): void {
    this.auth.loginWithRedirect();
  }

}
```

I also decided to display the user's name after they logged in:  

```html


<h1>Welcome!</h1>

<p *ngIf="user$ | async as user">
    User: {{user.name}}
</p>

<div>
    <button (click)="login()" mat-flat-button color="primary">Login</button>
</div>
```

In the micro frontend's ``AddressComponent``, I'm also using the ``AuthService`` to get some information about the current user:

```typescript
// projects/mfe1/src/app/address/address.component.ts

[...]

import { AuthService } from '@auth0/auth0-angular';

@Component({
  selector: 'app-address',
  templateUrl: './address.component.html',
  styleUrls: ['./address.component.scss']
})
export class AddressComponent {

  [...]

  constructor(
    private auth: AuthService,
    private fb: FormBuilder) {

    this.auth.user$.pipe(take(1)).subscribe(user => {
      if (!user) return;
      this.addressForm.controls['firstName'].setValue(user.given_name);
      this.addressForm.controls['lastName'].setValue(user.family_name);

    });

  }

  [...]
}
```

In order to make this work, we need to share the ``@auth0/auth0-angular`` package:

```javascript
// projects/shell/webpack.config.js
//  AND
// projects/mfe1/webpack.config.js

[...]
shared: share({
  [...]
  
  // Add this:
  "@auth0/auth0-angular": { singleton: true, strictVersion: true, requiredVersion: 'auto' },

  ...sharedMappings.getDescriptors()
})
[...]
```

This ensures there is only one ``AuthService`` at runtime we can use to share information about the current user. 

After changing the webpack configuration, we need to restart our applications. If everything works well, we can log in the user via the shell and read the user's name in the lazy loaded micro frontend.

## Summary

Module Federation allows loading separately compiled applications at runtime. Also, we can share common dependencies. This also allows sharing common data like information on the current user or global filters.

As Module Federation allows runtime integration, it is also the key for plugin systems and micro frontend architectures. However, this approach turns to compile-time dependencies into runtime dependencies; we need a sound set of integration tests to detect issues. 

In general, Micro Frontends only makes sense if you want to scale a project by splitting it into several smaller applications developed by different autarkic teams. If you only have one frontend team, Micro Frontend architectures are very likely an overhead.

Micro Frontends with Angular, Module Federation, and Auth0

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

The software’s latest features will help users bolster their data security.



If you happened to catch Apple’s initial June 4, 2018 announcement of iOS 12, you might have noticed that it was lacking the “big splash” that we’ve seen from other iOS announcements. That’s partially because Apple was so busy focusing on new iOS 12 data security features.

Though more is to be unveiled at the September 12, 2018 Apple Keynote event, many of the features of iOS 12 that have been revealed likely won’t catch the average consumer’s attention. That’s intentional. Good data security features are relatively unnoticeable to most users. If anything, those features in Apple’s newest mobile OS will make life a little bit easier for the average iPhone user.

But, if you happen to be an IT or security pro, the new iOS 12 probably piqued your interest.

This emphasis on personal data privacy and security from Apple prompts one question: is iOS 12 the most secure operating system Apple has ever released?

In a word, yes. Let’s dig into what makes it so secure.

## Better Anti-Hacking Technology for Data Privacy

One of the biggest changes Apple is making to the new iOS’s security is the introduction of USB Restricted Mode. 

On iOS 11 and earlier iOS versions, USB-based communications stay active for up to seven days after the phone is locked. This means that if an iPhone is stolen, the would-be hackers have seven days to plug a brute force device, such as GrayKey, into the phone and force it to unlock.

_[The New York Times](https://www.nytimes.com/2018/06/13/technology/apple-iphone-police.html)_ calls this seven-day window a massive security vulnerability in iOS 11.

The good news is that Apple is closing this window. With USB Restricted Mode on iOS 12, Apple is reducing the time for USB-based communications to just one hour after the phone is locked. 

That makes a brute force attack on iOS 12 nearly impossible. According to one app developer we talked to, “USB Restricted Mode essentially turns the phone into a battery-powered brick after one hour.” Unless the phone is unlocked by an authorized user in that hour timeframe, it’s useless to would-be hackers.

To illustrate this further, if an employee at your company has their iPhone stolen with iOS 11 on it, there’s a very good chance the thief will be able to gain access to the phone within seven days. However if iOS 12 is installed, the thief will only have one hour to attempt a brute force attack. The chances of that being accomplished in an hour are very unlikely. 

This data privacy feature is automatically turned on in the new OS, but Apple does give you the option of disabling it:

![Turn USB Restricted Mode Off in iOS 12](https://images.ctfassets.net/23aumh6u8s0i/43Cy7OyrsRaEn2felz1YVf/dce0db81be1260e1be29ba15fad941c2/ios12-usb-restricted-mode-off)

_[Image Source](https://www.macrumors.com/how-to/access-controls-usb-restricted-mode-ios-12/)_

We're excited by both the strength and flexibility of this for greater personal data security.

## Password Reuse Auditing

As is the case with any data security system, humans are the weakest link. If you develop the best tools in the world but the actual human operators aren’t using it, then it’s worthless.

That’s why Apple is trying to make password management as simple as possible in iOS 12. One of the features that makes this easier is Password Reuse Auditing. This feature monitors the passwords that iPhone owners use for different services. When it catches someone [using the same password on different websites](https://www.godaddy.com/garage/10-best-practices-for-creating-and-securing-stronger-passwords/), it flags the duplicate, offers a more secure password, and then saves it to the iCloud Keychain.

![iOS 12 Password Autofill - Password Reuse Auditing flag present on online service](https://images.ctfassets.net/23aumh6u8s0i/4xFwJwR593h6HlGI5SjAo/59a1d22b1766872c1ecc233dcf3a8cac/ios-12-password-reuse-auditing-flag-present-on-online-service)

_[Image Source](https://www.macrumors.com/how-to/automatic-passwords-and-auditing-in-ios-12/)_

The issues with using one password across different websites are well documented. Security experts have been trying to get around these issues for years and Apple is doing their best to help. Auth0 offers secure authentication using [token-based, passwordless authentication](https://auth0.com/passwordless) that features a brute-force protection system.

### iCloud: The Elephant in the Room

At first glance, this iOS 12 security feature seems slightly less secure. For this feature to work, Apple has to record your current passwords and be able to crawl them for matches. While at the same time, Apple stores everything in the iCloud. 

That concern caused Apple to make this system as secure as possible. This feature uses a highly secure 256-bit AES for encryption. 256-bit AES is nearly impossible to crack. It’s actually the same encryption standard that the US government uses to transmit top secret data. It seems that Apple is pretty serious about security. 

In addition to using the uncrackable 256-bit AES, Apple also recommends users enable two-factor authentication for their iCloud Keychain. That combination makes it extremely unlikely that some nefarious individual would be able to compromise the iCloud. 

Speaking of two-factor authentication…

## Making Two-Factor Authentication Easier

_[Two-Factor Authentication](https://auth0.com/learn/two-factor-authentication/)_ (2FA) is the next big security feature in iOS 12. 

For years, data privacy experts have been begging and pleading with website users to set up 2FA. It's one of the best ways to [protect individuals and small teams from cyber attacks](http://blog.idonethis.com/security-ringcaptcha/). Adoption has still been relatively low because 2FA adds an extra step for users.

The most common type of Two-Factor Authentication is SMS text message 2FA. This authentication protocol sends users a text with a passcode before they are granted access to a system.

The problem is, it requires a lot of switching back and forth between apps to get the code, memorize the code, and then plug it into the app. And, if the user mistypes or misremembers the code, then it's back to square one.

Luckily, Apple is coming to the rescue. With iOS 12, SMS security codes will autofill without the user having to switch from app to app. No memorization, either. It does this by making specific API calls to the messaging app. When iOS 12 recognizes an SMS 2FA security code, it will automatically pull it into autofill for the user. 

![iOS 12 SMS 2FA security code and autofill example](https://images.ctfassets.net/23aumh6u8s0i/5fZy2u7OvyQocoyZ7jLsLh/225753ebf85204d06fa4e6ddc2ad7feb/ios-12-recognizes-an-sms-2fa-code-and-autofills-it-for-user)

There is one downside here. It has been well established that SMS 2FA can be compromised. We recently mentioned this _[in a post about a Reddit data breach](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/)_. Even still, any 2FA is better than no 2FA. With Apple including this feature in iOS 12’s security, they’ve made users significantly less prone to hacking.

## What Else is New in Data Security for iOS 12?

There are a few other security features worth mentioning in iOS 12. First up is group video chat. What makes this a security feature? Facetime is fully encrypted and extremely secure. Adding group chat to Facetime simply means that Apple is now supporting fully encrypted group chats. 

Apple also introduced a new Face ID feature. The tech company is giving iPhone owners the ability to add a “second face.” This allows two different users to unlock an iPhone using Face ID. We’ve covered the _[security of Face ID](https://auth0.com/blog/is-faceid-really-secure/)_ is another blog post. It’s good to see Apple improving upon this feature.

## Final Thoughts iOS 12 Release

We’re really impressed with Apple’s new iOS 12 security features. Not only are they making the operating system more secure, they’re making security easier to use. That combination is one that security experts are always after. Be looking for "A new iOS update is now available" as iOS 12 will be released soon.

<include src="asides/AboutAuth0" />


Apple iOS 12: Is it the Most Secure iOS Ever?

ben-dechrai

A technologist with a staunch focus on security and privacy. I love helping developers find the joy of experimentation, and designing unconventional solutions for the purposes of learning something new.

Developer Advocate

Ben Dechrai

Configure MongoDB as an Auth0 custom database to simplify user migration or just add OAuth/Open ID Connect.



Configuring MongoDB as an Auth0 custom database can simplify your user migration process, or even just add an OAuth and OpenID Connect layer on top of your existing database of users. Whatever your reason, let's step through the process of connecting Auth0 to MongoDB.

<div style="text-align: center; font-style: italic">This article is also available in video format</div>
<AmpContent>
<amp-youtube
    data-videoid="TXnDFU4sG0A"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/TXnDFU4sG0A" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

## Enabling Custom Databases

Don't already have an Auth0 account yet? <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">**Sign up for free today!**</a>

<include src="SignupCTA" text="Try out the most powerful authentication platform for free." linkText="Get started →" />

Once you're logged in, head to the [Database Connections](https://manage.auth0.com/#/connections/database) page, and click on the **Create DB Connection** button.

Give this database configuration a meaningful name, click the **Create** button, and then switch to the **Custom Database** tab.

![Creating a new Custom Database in Auth0](https://images.ctfassets.net/23aumh6u8s0i/496MewuOZuw98e3bzPjxYP/39e421381b97dc89bb189cb35496095c/02-enable-custom-database)

On this screen, you can enable the **Use my own database** option and define the JavaScript that will run when the following events are triggered:

* **Login** - executed each time a user attempts to login, to validate the authenticity of the user against a MongoDB record;
* **Create** - executed when the user signs up, to create a record in MongoDB;
* **Verify** - executed after a user signs up and follows the email "verification" link, to set a corresponding flag in MongoDB;
* **Change Password** - executed when the user changes their password, or the reset email was sent and the user follows the "change password" link, to update a record in MongoDB;
* **Get User** - executed to determine the current state of existence of a user, which returns a matching MongoDB record if any, without requiring the user's credentials; and
* **Delete** - executed when a user is deleted, to deactivate or delete the respective MongoDB record.

For each of these scripts, you'll see a **Templates** drop-down above the code editor, and MongoDB is one of the options that come out of the box. You'll come back to this later.

![Using a predefined custom database script template](https://images.ctfassets.net/23aumh6u8s0i/1tHHzz76Yla76NbwM0Y7H0/b90b814d25bb6eb9600156ee00c82d32/02-custom-db-script-editor)

## Setting up a MongoDB Cluster

Before you do that, though, set up your MongoDB instance. Assuming you already have an account at [https://mongodb.com/](https://mongodb.com/), head to your dashboard and go to the **Projects** tab. Then create a new project, and in that project, create a new cluster. The free, shared clusters with the default settings are sufficient for our purposes, but you might want to consider one of the paid options if their features better suit your needs.

>This guide should also work fine if you're using an existing database, but you might need to tweak some of the upcoming instructions to your specific circumstances.

Once the cluster is built, which can take up to three minutes, you need some connection details to use in the scripts back in the Auth0 dashboard.

Click on the **Connect** button, and configure the IP Addresses that can connect to your cluster. If you look back in the Auth0 interface, you'll see a list of IP addresses under the code editors for any of your scripts. Add these in using the **Add a different IP Address** button in MongoDB.

![Finding Auth0's IP addresses for allowing access to MongoDB](https://images.ctfassets.net/23aumh6u8s0i/5OM015On791Fbrcfx6VvvV/52cad1ca1e118ceb94547c93ecf8a6cf/auth0-ip-addresses-closeup)

The next thing you need to do is define a user that's allowed to connect to the system. Choose a username and sufficiently strong password, and continue.

Finally, you get to choose a connection method. The scripts you're configuring in Auth0 fall under the **Connect your Application** scenario, and clicking on this will reveal the connection string you need to use in your scripts.

![Obtaining connection details from MongoDB](https://images.ctfassets.net/23aumh6u8s0i/4cSocZbkMPCMFOggiaXyT0/6ec4e02b4cb76cd64d09197d1d4964b7/03-mongodb-connection-details-window)

## Defining the Auth0 Custom Database Scripts

Copy the connection string from MongoDB, and switch back to the Auth0 interface. Select to edit the **Login** script, and choose MongoDB from the templates drop-down.

You'll see the following line in the code:

``` javascript  
const client = new MongoClient('mongodb://user:pass@localhost');
```

Replace the entire connection string with the value you just copied from MongoDB, and you'll see something that looks like:

``` javascript  
const client = new MongoClient('mongodb+srv://user:<password>@xxx.mongodb.net/<dbname>?...');
```

You can remove `<dbname>` from this connection string, because it's already specified later in the script.

``` javascript  
const client = new MongoClient('mongodb+srv://user:<password>@xxx.mongodb.net/?...');
```

Now you need to replace `<password>` with the actual password, but you know it's bad practice to keep these in the scripts.

There's a solution for this, though. Under the script editor, you'll see a **Settings** section that allows you to store data exposed to all the scripts via environment variables. This is a much more secure way to store the password.

Add a key/value pair with the key `MONGO_PASSWORD` and the password you provided when configuring access in MongoDB.

![Storing credentials securely for use in Auth0 custom database scripts](https://images.ctfassets.net/23aumh6u8s0i/2qRxG3H9r2JrR8oAkKuhUn/b2c23edc2154e7482165fc8623eacc53/04-custom-db-script-settings-window)

You'll then be able to copy the **Code Snippet** from the new entry, and use that in your connection string instead:

``` javascript  
const client = new MongoClient('mongodb+srv://user:' + configuration.MONGO_PASSWORD + '@xxx.mongodb.net/<dbname>?...');
```

## Creating the Mongodb Database to Store Users In

The next thing you'll need to do is create a database and collection in MongoDB. Jumping to the MongoDB interface again, close the dialog box containing the connection information and click on the **Collections** button.

On the Collections page, click the **Add My Own Data** button, and provide the database name `db-name` and the collection name `users` and click **Create** to continue.

![Creating a database and collection in MongoDB](https://images.ctfassets.net/23aumh6u8s0i/2FGBFo0xCA7WIuAv1rBeTj/d9fc99f7483d0adc4d969845c2aed954/05-create-db-and-collection-window)

That's it for this step! The database is ready, and you just need to finish up the Auth0 custom database configuration.

## Finalizing the Auth0 Custom Database Scripts

Switch back to the Auth0 interface again and you should see the **Login** script editor. The script is already connecting to the `db-name` database and pulling users out of the `users` collection. If you used other names in the previous step, make sure you update the code in all the scripts on around lines 8 to 10:

![Code showing database and connection name definitions](https://images.ctfassets.net/23aumh6u8s0i/J3utFvV9KFRfeUuy2Vwax/d2cb5e1ef195473184403244a1daf165/script-configure-db-and-connection-names)

Before you move on, copy line 4 into your clipboard, which instantiates the client with the correct connection string.

To configure the other scripts, simply iterate through each one, select MongoDB from the templates dropdown, and replace the client instantiation line with the one you just copied from the **Login** script.

There are just two more little changes you'll need to make to make everything work.

By default, each new user won't have an `email_verified` flag at all, so setting it later won't work. To remedy this, head back to the **Create** script, and find the line that defines the value of `user.password`:

``` javascript  
user.password = hash
```

This is probably line 24. Directly after this line, add the following:

``` javascript  
user.email_verified = false
```

Now, when someone creates a new account, the new user object in MongoDB will be created with the `email_verified` flag as false.

The second change is to the **Delete** script. On around line 11, you'll see the line that tells MongoDB to delete the user:

``` javascript  
users.remove({ _id: id }, function (err) {
```

The issue here is that the value of `id` is the user's email address, whereas the `_id` in MongoDB is an object ID. Change the key in this filter to `email` in order to correctly identify the MongoDB record to be removed:

``` javascript  
users.remove({ email: id }, function (err) {
```

Clicking on the **Save** button above the code editor will save all changes in all the scripts. So hit that, and you're done!

## Testing the Database

You can use the **Try** button to test each of these scripts out now. If you're starting with a new database, try the **Create** script first, and go from there.

![Testing the Auth0 custom database by creating a new user](https://images.ctfassets.net/23aumh6u8s0i/1hc21gDm65ROXTXVQstdYB/8becfaa89d9735532be3d1c449a9a208/06-user-created)

If you're using an existing database, you can try logging in with an existing user's credentials. If you're having authentication issues, make sure the **Login** script is using the same hashing mechanism as the code that generated these users in the first place.

And if you're having trouble, head over to our Community Forum and drop your request below.


Connecting Auth0 to MongoDB

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Advanced contextual-based feature only triggered by risky logins, mitigating hacking attacks, and reducing threat of data breaches while preserving user experience.



**BELLEVUE, Wash. – Dec. 15, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today launched [Adaptive Multi-factor Authentication (MFA)](https://auth0.com/blog/auth0-introduces-adaptive-mfa), a sophisticated security feature that helps reduce the threat of hacks and data breaches. Adaptive MFA is an important addition to Auth0's expanding security portfolio&mdash;which also includes Bot Detection, Breached Password Detection, Brute Force Protection, and Suspicious IP Throttling&mdash;and is one of the platform's most advanced context-based security features.

Adaptive MFA is designed to help companies address the inherent challenges of enabling security while preserving user experience. Unlike traditional MFA, which is triggered upon every login attempt and creates an additional step for the end user, Adaptive MFA only appears when a login is deemed risky. This is calculated by an overall risk score that measures abnormal behavior from known devices, impossible travel, and/or IP reputation. Customers can have the confidence that with Adaptive MFA, their end users are asked for secondary authentication only when behavioral signals don't conform to usual patterns for a particular user. 

For example, for a user who normally signs into their account at the same time every morning in San Francisco from a personal laptop, Adaptive MFA would only present a second-factor authenticator if login was attempted outside of the region, usual timeframe, or from a different computer or IP address. Developers can determine how much weight each signal is given to define the risk score that sets off the trigger. 

Many companies are reluctant to implement MFA&mdash;proven to be an effective defense against account hacking attacks&mdash;out of fear of negatively impacting user experience and thus their conversion and retention performance. However, additional friction during the signup, login, or checkout experiences can affect user conversion/retention, resulting in lost sales, and can potentially increase support incidents. Forrester predicts that the MFA market will grow to $2 billion by 2023[1], and this anticipated growth signals the need for a more intelligent and contextually-based MFA solution.   

"Auth0's mission is to provide secure access for everyone. Securing identities is core to that mission, and this new capability adds to the already powerful features in our security profile, designed to counter a variety of sophisticated threats, such as automated attacks, account takeovers, and phishing attacks," said Shiven Ramji, Chief Product Officer at Auth0. "Adaptive MFA should be a key consideration for any enterprise that has previously had to make a tradeoff between security and user experience. The ability to reduce friction while increasing security is a competitive differentiator for our customers."

More detailed information on Adaptive MFA can be found here: [When is MFA the Right Choice?](https://auth0.com/resources/whitepapers/is-mfa-the-right-choice) (whitepaper) and on Auth0's [Multi-factor Authentication](https://auth0.com/multifactor-authentication) page.

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications <br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com) <br />

Matter for Auth0 <br />
[auth0@matternow.com](mailto:auth0@matternow.com) <br />

(1): Forrester Analytics: IAM Software Forecast, 2018 to 2023 (Global)


Auth0 Launches Adaptive MFA to Increase Security and Reduce Friction for End Users

kapehe-jorgenson

Kapehe is an R&D Content Engineer for Auth0 with a passion for learning and teaching. With her primary focus on ReactJS and JavaScript, she is impressed with what code can create for the web. Technology and web development are constantly evolving and naturally bring that need for continual learning. She enjoys writing tutorials, hosting local meetups, and learning with others to expand coding knowledge.

R&D Content Engineer

Kapehe Jorgenson

See how quick it is to add the user's country and time zone to user data using Auth0 Rules



Ready for a quick bite of information?

In this article, we will talk about Auth0 Rules and how awesome they are in adding specific log in allowances, restrictions, or extra functionality.

We will be focusing specifically on the rule that adds the user's country and time zone to their profile information. That way, we can see where our users are logging in from and how much of a global impact our application is having!

> The use case and need for this specific rule is dependant on the application.

## But What is an Auth0 Rule?

[Auth0 Rules](https://auth0.com/docs/rules) allow us to add specific "rules" to our application quickly. By flipping a switch in our Auth0 Dashboard, we could set user roles, turn on multi-factor authentication (MFA), or force email verification.

Let's set one up!

> Already have an app set up with Auth0 authentication? Go ahead and skip to the "Auth0 Rules" section of this article!

<include src="TweetQuote" quoteText="Auth0 Rules allow us to add specific rules to our application quickly!"/>

## Grabbing an App

Let's set up an application. For our example today, we will be using [this GitHub Repo](https://github.com/auth0-blog/vue-events-auth) from [this article](https://auth0.com/blog/beginner-vuejs-tutorial-with-user-login/) on authenticating a Vue app.

Run the following commands in the terminal to `clone` and `cd` into the project:

```bash
git clone https://github.com/auth0-blog/vue-events-auth.git
```

```bash
cd vue-events-auth
```

Now that we are in our Vue application, let's go set up our Auth0 app! Don't worry, we'll come back to this app!

> Auth0 Rules can be used anywhere an Auth0 application is being used.

## Setting up Auth0

To begin, we will need an Auth0 account. We can sign up for a <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">free Auth0 account here</a>. Once we are logged in, follow these steps to set up an Auth0 application:

1. Go to the [**Auth0 Dashboard**](https://manage.auth0.com/#/) and click the "+ CREATE APPLICATION" button.
2. Name the new app and select "Single Page Web Applications". Hit "Create".
3. In the **Settings** for the new Auth0 application, add `http://localhost:8080` to the **Allowed Callback URLs**, **Allowed Logout URLs**, **Allowed Web Origins**. 
4. Hit "Save Changes" at the bottom of the page.

## Linking the Auth0 Application to our Vue Application

Next, let's return to our application, and we'll do the following steps:

- Install dependencies: `npm install`
- Create a new file in the root of the project: `auth_config.json`
- Input the following code and update it to be your specific credentials:

```json
{
  "domain": "your-domain.auth0.com",
  "clientId": "yourclientid"
}
```

These values can be found in your "Settings" tab of the Auth0 Application we just created earlier!

- To start the app: `npm run serve`
- View the app: [http://localhost:8080](http://localhost:8080)

We should now see this!

![Initial view of the Vue app home page](https://images.ctfassets.net/23aumh6u8s0i/1KwQetS3dUWYpj4GZOETEO/0a12b9796a12a24cd0ecc9b2c59f98e1/app-view-tiny)

## Auth0 Rules

Let's head back to our [Auth0 Dashboard](https://manage.auth0.com/#/). Once there, let's click on ["Rules"](https://manage.auth0.com/#/rules) in the left-hand menu. Now, let's click on the "+ CREATE RULE" button.
 
![Picture of "Create Rule" button](https://images.ctfassets.net/23aumh6u8s0i/1ZHizCdOr0dZa0g47htu24/c4dde708f4dedee4037d87f950f698a6/create-rule)

## Adding in the "Country" Rule

For this quick bite tutorial, we will be activating the Auth0 Rule that will add the user's country and time zone to their user data.

We have already clicked on "+ CREATE RULE" so now we should see a long list of different rules. Find the one that says "Add country to the user profile" and click on it.

We'll see a bunch of code showing the rule and how it works, but all we need to do to activate this rule is to click the "SAVE CHANGES" button.

And that's it! If we return to the "Rules" dashboard, we should now see that rule listed:

![Rule dashboard view of added rule](https://images.ctfassets.net/23aumh6u8s0i/1jPbg1hg1fqmwpnTuveO8z/2b0fb8274f2a7fa40c09b352c062e0f7/rule-added-view)

<include src="TweetQuote" quoteText="I just added an Auth0 Rule to my Vue application!"/>

## Getting User's Country

Let's double-check that this works! To do so, we will need to add a `console.log` into our code to see the user's data.

In our Vue project, navigate to `src/auth/index.js` and input the following line at the bottom:

```js
// src/auth/index.js

// code at top of the file

      } finally {
        // Initialize our internal authentication state
        this.isAuthenticated = await this.auth0Client.isAuthenticated();
        this.user = await this.auth0Client.getUser();
        this.loading = false;
        console.log(this.user); // THIS LINE IS NEW!!
      }
    }
  });
  return instance;
};
```

Go back to our [`localhost:8080`](http://localhost:8080/), open up dev tools (right click and hit "Inspect"), and hit "Console" so that we can see when the `console.log` is initiated.

Log in to the application, follow the instructions for logging in, and once logged in, we'll see the user's object show up in the console.

![User data in dev tools showing country and time zone data](https://images.ctfassets.net/23aumh6u8s0i/6SBLIIsp6XnrQfOdAWR0vy/d46787f550fa86352ba4748179da1fc0/user-data-with-country)

As we can see in the photo, two lines are showing my country and time zone!

```json
https://example.com/country: "YOUR COUNTRY"
https://example.com/timezone: "YOUR TIME ZONE"
```

Now we have our user's country and time zone data!

## That's All Folks!

Without having to write the logic out ourselves, the Auth0 Rule gave us that extra bit of functionality that we may need for our project.

There are so many [Auth0 Rules](https://manage.auth0.com/#/rules) to choose! Try them out and let us know in the comments below which one has helped you out the most!

---


Adding Country to a User's Profile with Auth0 Rules

jeff-moss

Jeff is a Product Security Engineer that is passionate about security and privacy-first software. He has experience in secure engineering in the public and private sectors and has developed and secured security software used to protect critical infrastructure. Jeff leads the Product Security Team in making our identity platform secure and trusted. When not building and breaking things, he can be found playing with his two dogs, hiking or bicycling.

Lead Product Security Engineer

Jeff Moss

How to create a great experience while taking a security-minded approach to user data design.



I love shopping for tools. You may have heard the saying “you can’t have too many tools.” It is quite frustrating when you don’t have the right tool for the job! In the software world, developers have the propensity to look at data in the same way that I look at buying tools; i.e., “I might need this in the future.” In this article, I hope to convince you to dispel this gobble-up-all-the-data thought process.

Let’s visualize your application as a ship. The data you use serves as the ship’s ballast, a heavy material, such as water or sand, placed low in a vessel to improve its stability. Just enough ballast keeps the boat stable and maximizes your cargo. Any more ballast than the minimum required adds unnecessary risk to your journey (and also reduces the cargo that you can carry).

![User experience becomes dangerous when data is overused](https://images.ctfassets.net/23aumh6u8s0i/21njlcdHsbFf8qAFcEBPAV/0d9295882c0312d5f6e2bfdddc3d114a/ux-made-dangerous-with-data-overuse)

Too much data may translate into a poor experience and lose user trust. Your users may ask themselves, "Why do I have to share my location on this Solitaire app?"

![User experience is made dangerous when data is underused](https://images.ctfassets.net/23aumh6u8s0i/7MSOOj8MoDefqIGoZeGaKd/eda09e9277c6a4641cd933f93bd5e57e/ux-made-dangerous-with-data-underuse-)

Too little data may translate into poor user experience because you may not be able to tailor and personalize the UX for your users.

![User experience is stable and true with the minimal amount of data](https://images.ctfassets.net/23aumh6u8s0i/1yzlXuut85Vc3n8AZkhin8/8fbfc5f0415f6647545020d5d7549c06/ux-stable-and-true)

Having the right (minimal) amount of data should maximize the user experience. Every piece of data must serve a purpose for the user and bring value.

Developers want to provide the best experience for their users. Often, providing a great user experience means collecting their data. For example, in an application, a developer may use location data to set a geofence to improve the user’s experience while they visit a physical store. What data should they collect and how should they handle it?

For each piece of user data collected, there are hidden costs of that data in the form of:

- Compliance (GDPR, HIPAA, PCI, etc)
- Security
- Privacy

Each of these topics are entire disciplines, and there is a lot of literature — valuable or otherwise — covering them in heavy detail. We will be focusing broadly on reducing our risk across these areas.

## Real example: Abusing Data From Open Sources and Breaches

Let’s consider a real-world attack where attackers were able to abuse data from open sources and recent data breaches, such as Equifax and other smaller ones, to create ~$25k in credit card charges

Someone I know was directly affected by a breach in security controls through data gathered through Open Source Intelligence ([_OSINT_](https://en.wikipedia.org/wiki/Open-source_intelligence)) and likely information purchased on the dark web obtained through data breaches.

We’re going to call this person Candice (fake name to protect the innocent). One day, Candice opens her credit card statement and notices that there's ~$25,000 on the card that she didn't spend and a new account was added.

Candice and I did a little research, and here’s what we think happened.

Candice is your average consumer. She turns on multi-factor authentication (MFA) for her banking accounts when it is required and she is also moderately successful at using different passwords for each of her accounts.

Like many of us, Candice’s information, including her Social Security number, was exposed in the Equifax breach and some smaller breaches. She probably also re-used her password elsewhere. With some [_credential stuffing_](https://auth0.com/blog/credential-stuffing-is-a-persistent-threat-to-your-users/), where attackers use previously breached passwords on other sites in an attempt to gain access, attackers were likely able to gain the first step of authentication but were not able to get past the multi-factor authentication challenge.

However, with a little extra OSINT to obtain her address, phone number, age, family members, pets’ names, etc., the attackers were able to build a whole profile on Candice and use it for social engineering and identity theft. Armed with the right combination of details about Candice, attackers were able to bypass the security controls enforced by the bank through customer support. The bank eventually flagged the fraudulent charges and, luckily, Candice’s credit ended up fine.

As a savvy user of the internet, it is always a best practice to consider the information that you share could be used for other purposes. For example, some Facebook memes included lists of first or important life events, such as “where did you first meet your spouse.” This is a gold mine of OSINT for attackers that are trying to access websites that still use security questions as additional factors.

Each individual will need to consider their own threat model on the information they share. It isn’t easy to anticipate where OSINT data can be collected and how it could be abused, and this is where developers come in as first defense. As Vanderbilt University James Hazel told the Business Insider [_in this excellent piece on anonymized DNA data_](https://www.businessinsider.com/privacy-security-risks-genetic-testing-23andme-ancestry-dna-2019-2), "Data is data — once it's out there, it's very hard to control." Treating user data as a liability protects your users by making it more difficult to obtain and be used maliciously in other places you might not expect.

<include src="TweetQuote" quoteText="Real-world example: Equifax breach + smaller breaches + OSINT = ~$25K+ credit card charges. Find out how @auth0’s security-minded approach to user data design could have helped."/>

Back to our geofencing problem. Let’s say your company wants to know the following information:

- **Adoption rate:** how many people are using the application in the store

- **Conversion rate:** whether a person used the app and then went to the store within a certain period

There are a lot of inputs available to answer these questions:

- GPS location
- Nearby WiFi
- Nearby Bluetooth
- IP Address
- Unique ID of the device
- User ID
- Items searched
- Timestamp

We could store all of this data as a single record and send it to the server every time the user logs in the app. If the record is within the geofence, we can process whether or not it was a conversion and increase the adoption count. This seems like a lot of information for a couple of reasonably simple questions (resist that feeling of “but we may need this data in the future”). Don’t forget to call in compliance and security on this one. In other words, we’re carrying a lot of ballast in this ship.

Instead, what if we stored a record that included the following in the client application:

- `lastLogin` (timestamp)
- `inGeofence` (boolean)

These two data points represent the condition whether the user within the geofence the last time they logged in. To determine if the user is within the geofence, our application would store the geofence boundary and request permission to use location services when it is running. In this case, we don’t really need to save the `lastLogin` or `inGeofence` information on the server, we can store it temporarily and use it to determine whether the next request is a conversion.

> Side note: Let’s acknowledge that client-side calculations are not always appropriate, make sure to consider your threat model.

When the user logs in to the application, the application can check the previous `inGeofence` record as well as calculate a new one. Then, if the user is within the geofence, the application could send the following to the servers:

- `uniqueId` (random string)
- `isConversion` (boolean)

UniqueId would serve as a way to uniquely identify our new data point. In this case, we could choose to use a random string.

`isConversion` is inferred as true if the last login was not geofenced and occurred within our specified timeframe. We’ll increment our adoption count as aggregated data based on the number of unique requests. We have managed to take rich real-time user data and only transfer and persist the results that we want to measure. We have accomplished our business needs while minimizing risk, and can follow this same process when new features are needed. This process will help us purposefully select the data that we need rather than use whatever we can collect.

The design scenarios that you encounter will likely be much more complex than the geofencing example above. Consider the following user data security principles to kickstart the discussion on your next project remembering that each piece of user data you collect is a liability:

- Clarify your objective and identify the minimum amount of data necessary to meet it

- Design the use of data in your applications to address only the specific need

- Consult compliance, security, and privacy experts on your data choices

- Transfer and store aggregated, calculated or inferential data over raw user data

  - **Aggregated:** adoption count vs sending the user’s identifying data

  - **Calculated:** `inGeofence` vs sending the user’s GPS location

  - **Inferential:** `isConversion` vs sending the user’s login history, timestamp and GPS location

- Resist the urge “because I might need it”

- Consider how the data could be abused when combined with other sources, such as what happened to Candice

<include src="TweetQuote" quoteText="Treat data as a liability. Find out how designing for only the data you need can protect your end-user and your company."/>

On your next design, take the engineering challenge of minimizing user data just like you would consider scalability or performance. Throughout the design process sometimes you won’t be able to reduce your user data liabilities. At a minimum, incorporating the security principles above helps you identify those liabilities and handle them appropriately (some boats need a lot of ballast just to stay afloat). The next time you are ready to “ship it”, check your ballast and you will be better prepared for rough waters. If you'd like to learn more about how Auth0 can help you securely collect only the authentication and authorization data that you need, please reach out to an [_Auth0 resource._](mailto:%20sales@auth0.com)

<include src="asides/AboutAuth0" />


Avoid Sinking Your Code by Treating Data as a Liability

Sam4-square

I'm an Identity nerd with many years of experience as a developer and advocate. I love explaining complex topics clearly and understandably. You can find me on stage at developer events worldwide or simply having great conversations in the hallway. Google has recognized me as a Google Developer Expert (GDE) in the domains of Web Technologies, Security, Privacy, Payments, and Identity.

Principal Developer Advocate

Sam Bellen

With resident credentials you can create a smoother, username-less login experience by saving some of the user data on the authenticator.


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Want to learn more about WebAuthn? Then head over to <a href="https://webauthn.me/">webauthn.me</a> and don't forget to try the brand new debugger!</strong>
</div>

**TL;DR:** With the release of version 76, Google's Chrome browser [now supports WebAuthn resident keys](https://www.chromestatus.com/feature/4627499185078272). These allow for a smoother, username-less login experience by saving some of the user data on the authenticator. Let's have a look at how this works.

## WebAuthn Until Now

In a typical WebAuthn scenario, a credential ID is generated by the authenticator and saved on the server. This ID is used to identify the saved credential on the authenticator. We will save this credential ID linked to a username or other user identifiable property in our database.

When a user wants to authenticate using a previously created credential, they will enter their username in a login form. The server will look up the saved credential ID for this username and pass it along to the authenticator. The authenticator will then use this ID to select the correct credential to sign the authentication challenge.

This is a good solution, it eliminates the need for a password, and authenticates using the keys generated by the authenticator. The user still needs to enter a username every time they want to login. We can do better!

## Resident Credentials

When setting the `requireResidentKey` property to true, will force the browser to create a new client-side-resident public key credential source or resident credential for short, on the authenticator. With these resident credentials, the authenticator is able to select the appropriate credential private key based on the relying party ID.

For example, a user registers new credentials for the relying party with ID `auth0.com`. Any subsequent authentication request with that relying party will use the saved resident credential to find the corresponding credential private key unless an array of allowed credentials is configured in the `navigator.credentials.get()` options. 

To create a resident credential, you need an authenticator that is capable of creating one of these. Not all authenticators can do this. A Yubikey (4 or 5) and most other devices that support FIDO2 should be able to do this. There’s one caveat, your Yubikey should have a pin configured. If you don’t have an authenticator that supports resident credentials, it will throw an error.

## Step by Step

Let’s walk through this scenario step by step.

A user is new to your website and wants to configure a new credential using WebAuthn. You configured your relying party to set the `requiresResident` option to true, so the browser will try to create a resident credential.

Chrome will prompt the user which authenticator to use if it has found more than one.

![Choose an authenticator](https://images.ctfassets.net/23aumh6u8s0i/2xbPAhm7uuUnOoDctv9AZV/ddc965236705abf92d81d36cc602753f/choose-authenticator)

After selecting the authenticator of your choice, the browser will ask you to perform an action. In the case of my Yubikey 5C, it asks to touch the key. Note that it also mentions “A record of your visit to this site will be kept on your security key”. This “record” will be our resident key.

![Touch your security key](https://images.ctfassets.net/23aumh6u8s0i/2ntMji45OFRpMRd86vucC8/fde5589c360dd65b5fd6d152b30527ed/insert-authenticator)

If you don’t have a pin code configured on your authenticator, Chrome will ask you to do this at this point.

![Configure a pin code](https://images.ctfassets.net/23aumh6u8s0i/6EV7MFea4JlLilgVspP8ri/a3f5b33ac7ba4c8d65e30aada4cd9288/set-pin)

In case you already set up your authenticator with a pin code, you will have to enter the pin to continue.

![Enter your pin code](https://images.ctfassets.net/23aumh6u8s0i/38BniTjL2ASqlBEjwDDaSG/ff4258b36ae2300b830e62bce75c26c6/enter-pin)

To complete saving the resident credential, the browser will prompt a second time to confirm you want to create this credential.

![Confirm by touching your security key](https://images.ctfassets.net/23aumh6u8s0i/7BY9Q23ra2CXTEUmhqrKAW/888c98a897b180839b67ab4536a791bf/confirm-request)

We now have successfully registered a new client resident credential. When authenticating in the future, the browser will automatically use this credential, based on the relying party ID.

When there are more than one resident credentials saved on the authenticator, the browser will show a dialog where the user can select the credential they would like to use to authenticate.

![Choose which credential to use](https://images.ctfassets.net/23aumh6u8s0i/6IDvveTf1tv5n6TZjQL6o4/b02f58c082cb1d05a737cf3af3cb2099/choose-credential)

## Conclusion

After Microsoft's Edge browser already supported resident credentials, now also Chrome supports this feature. These kinds of credentials are saved on the authenticator, and allow the user to authenticate without even entering a username. The browser will recognize these credentials based on the relying party ID configured in the WebAuthn authentication request.

## Resources

[Introduction to Web Authentication](https://auth0.com/blog/introduction-to-web-authentication/)<br>
[webauthn.me](https://webauthn.me/)<br>
[WebAuthn Debugger](https://webauthn.me/debugger/)<br>




A Look at WebAuthn Resident Credentials

30b8d1b7c0dab4bb311c121a47a6aae9?s=80 avatar

30b8d1b7c0dab4bb311c121a47a6aae9?s=80

Guest Author

Vladimir Fomene

Learn how to use Express Validator, a set of middleware functions, to perform server-side validation on user data.



**TL;DR:** In this article you will learn to validate and sanitize data in your Express.js
applications using a set of middleware called [`express-validator`](https://express-validator.github.io/docs/). You will do so by completing a demo application that takes in user input and validates/sanitizes it using
this library. If you want to see the complete application developed throughout this article, take a look at [this GitHub repository](https://github.com/auth0-blog/expressjs-validator).

## Prerequisites

Software you need to install to follow this tutorial:

* [Node.js and NPM (Node Package Manager)](https://nodejs.org/en/download/). While writing this article, the author used Node.js `v8.13.0`.
* Any text editor or IDE of your choice ([VS Code](https://code.visualstudio.com/), [WebStorm](https://www.jetbrains.com/webstorm/download/), [Atom](https://atom.io/), [Sublime](https://www.sublimetext.com/), etc.).

## What Is Express Validator?

According to the [official website](https://express-validator.github.io/docs/), Express Validator is a set of [Express.js middleware](http://expressjs.com/en/guide/using-middleware.html) that wraps [`validator.js`](https://github.com/chriso/validator.js), a library that provides validator and sanitizer functions. Simply said, Express Validator is an Express middleware library that you can incorporate in your apps for server-side data validation.

### Why Server-Side Validation?

Mainly speaking, you _must_ care about server-side validation because data coming from other clients (single-page apps, regular web apps, mobile applications, etc.) cannot be trusted. For example, your servers have no means to know if a malicious user (or virus) disabled front-end validation (e.g., JavaScript) to allow the app to submit bogus data to your server. That is, client-side validation is _not enough_.

## Set Up Your Playground For Express Validator

To start playing with Express Validator, you will clone a simple Express server to use as a playground. To do so, open your terminal in a preferred directory and clone the starter project with the following command:

```bash
# clone repository
git clone https://github.com/auth0-blog/expressjs-validator.git

# move into your clone repository
cd expressjs-validator
```

Then, install all the project dependencies by running the following command in the project root:

```bash
npm install
```

This simple Express application contains just enough for you to get started and focus on learning about the `express-validator` library. For example, if you check the `views/layout.pug` file, you will see that it contains some basic HTML elements to define how the app should look like.

> **Note:** If you are not familiar with [Pug, the template engine](https://pugjs.org/api/getting-started.html), you might find the syntax of this file a bit different. Don't worry, you don't need to be acquainted with Pug to follow this article along. Also, if you take a close look to the source code, you will probably understand what is going on. For example, you will see a line starting with `link` that contains the `href` keyword pointing to a [BootStrap](https://getbootstrap.com/) file. This is just the code telling the browser to import an external CSS file, quite similar to what you would do in HTML.

Besides the `views/layout.pug` file, these are other important files that you must know about:

- `./routes/index.js`: This file is responsible for rendering the homepage of your app. The `res.render('index')` line will make Express and Pug work together to render the `views/index.pug` file.
- `./routes/users.js`: For now, this file adds an endpoint to your app that doesn't do anything. Soon, you will start using this file to learn about the `express-validator` library.
- `./public/javascripts/script.js`: This is the file that will be in charge of sending user data to your backend. The requests will be some AJAX calls to the endpoint defined on the `routes/users.js` file.
- `./app.js`: This is the file responsible for bootstrapping the backend. This file sets up Pug as the template engine and tells Express.js where to find the other JavaScript files.

With that, you now know how the app is structured, but don't run the project yet! You still need to define the home page of your app.

## Build Homepage For User Input

After learning about the structure of the playground, you will need to add the following code to the `views/index.pug` file:

```pugjs
extends layout

block content
  .container
    .alert(class="alert-danger", role="alert", id="error-group", style="display: none")
      ul(id="errors")
    .row
      .col-sm.col-md-8.offset-md-2.col-lg-6.offset-lg-3
        h3 Welcome To Express Validator!
        form
          .form-group
            input.form-control(type="text", id="name", placeholder="Name")
          .form-group
            input.form-control(type="text", id="classYear", placeholder="Class Year")
          .form-group
            input.form-control(type="text", id="weekday", placeholder="Available Weekday")
          .form-group
            input.form-control(type="email", id="email", placeholder="Email")
          .form-group
            input.form-control(type="password", id="password", placeholder="Password")
          .form-group
            input.form-control(type="password", id="confirmPassword", placeholder="Confirm Password")
          .form-group
            button.form-control(type="button", class="btn btn-primary", id="signup-btn") Submit
```

What you are doing here is to add a bunch of `input` elements to the homepage that will receive user input to be sent to the backend. With that covered, you have everything in place to have a sneak peek at the app. Go to the project root directory
and run the following command to get the app started.

```bash
node app.js
```

Now, if you visit [`http://localhost:3000/`](http://localhost:3000/) in your favorite browser, you should see the following page:

![Express Validator Tutorial: Scaffolding the sample app.](https://images.ctfassets.net/23aumh6u8s0i/4HKvT3HZ3MqdXsTZMKUaqQ/5e1105b1c1c24aad89af2bee6938c70e/app-screenshot)

> **Note:** You can stop the server now, but whenever you add a new feature/functionality, you will need to restart the server if it is already running or just start it.

Once the user enters data on your homepage and clicks the **Submit** button, you will need to handle the on submit event and make an AJAX request to your Express back-end. To do that, add the following code to your `./public/javascripts/script.js` file:

```js
$('#signup-btn').click(function () {
  $.ajax({
    url: '/users',
    type: 'POST',
    cache: false,
    data: {
      name: $('#name').val(),
      classYear: $('#classYear').val(),
      weekday: $('#weekday').val(),
      email: $('#email').val(),
      phoneNumber: $('#phoneNumber').val(),
      password: $('#password').val(),
      confirmPassword: $('#confirmPassword').val()
    },
    success: function () {
      $('#error-group').css('display', 'none');
      alert('Your submission was successful');
    },
    error: function (data) {
      $('#error-group').css('display', 'block');
      var errors = JSON.parse(data.responseText);
      var errorsContainer = $('#errors');
      errorsContainer.innerHTML = '';
      var errorsList = '';

      for (var i = 0; i < errors.length; i++) {
        errorsList += '<li>' + errors[i].msg + '</li>';
      }
      errorsContainer.html(errorsList);
    }
  });
});
```

From the code above, on form submission, a POST request is made to the `http://localhost:3000/users` endpoint with the data entered by users on the HTML fields defined before. If there is an error during validation, this code will make sure to display the error messages inside a `div` marked with the `alert` class. If no errors are found, a successful validation will trigger an alert with this message: "Your submission was successful".

## Server-Side Validation With Express Validator

Now that you have your front-end set up, you will start learning about `express-validator`. To do that, the first thing you will need to do is to install the library:

```bash
npm install express-validator --save
```

After installing `express-validator`, open the `routes/users.js` file and import the [check API](https://express-validator.github.io/docs/check-api.html) to use its validation functions:

```js
// ... call to require('express') ...
const {check, validationResult} = require('express-validator/check');

// ... leave the rest untouched ...
```

### Making sure fields are not empty

Now, to validate your form input, you need to pass an array in which you specify the fields that you want to validate as a second argument to your route handler for `/users` POST requests. To do that, add the following code after the GET route handling code in `routes/user.js`:

```js
// ... require statements ...

// ... router.get ...

router.post('/', [
    check('name').not().isEmpty().withMessage('Name must have more than 5 characters'),
    check('classYear', 'Class Year should be a number').not().isEmpty(),
    check('weekday', 'Choose a weekday').optional(),
    check('email', 'Your email is not valid').not().isEmpty(),
    check('password', 'Your password must be at least 5 characters').not().isEmpty(),
  ],
  function (req, res) {
    const errors = validationResult(req);
    console.log(req.body);

    if (!errors.isEmpty()) {
      return res.status(422).jsonp(errors.array());
    } else {
      res.send({});
    }
  });

module.exports = router;
```

The string passed as an argument to the `check` function specifies which data field you want to validate (e.g., `classYear`). The `not().isEmpty()` function chain makes the library validate that this field is not empty. The string argument added to `withMessage()` specifies a custom error message which will be send back to your users if this particular field violates a validation requirement.

> **Note:** You can also provide a custom error message by passing it as a second argument to the `check()` function.

By calling the `optional()` function on it, you have made the `weekday` field optional. So far, you have only specified how you want your fields to be validated. You might be wondering where Express.js actually does the validation. Validation happens in the request handler when it calls the `validationResult()` function. To test this, run your application and submit an empty form to the server and you should see the following error displayed in red.

![Express validator showing error messages.](https://images.ctfassets.net/23aumh6u8s0i/55oL7TnIWUeSSUPWph5aal/fc62311dd2d57123edf25666b015efc5/error-messages)

Remark how there is no error for the **weekday** field, this is because you made the field optional during validation. Pretty cool, huh?

### Validating fields' length

You can also check if a data field meets a certain character length requirement by using the `isLength()` function. This function takes in an object in which you specify the minimum and/or the maximum number of characters in that field. To see this in action, update the validation requirements for the name and password field as follows:

```js
[
  // ... leave other validations untouched ...
  check('name').not().isEmpty().isLength({min: 5}).withMessage('Name must have more than 5 characters'),
  check('password', 'Your password must be at least 5 characters').not().isEmpty().isLength({min: 5}),
]
```

Now, restart the app and try to enter a name and password less than five characters long. You should see the app complaining about the field length.

### Validating fields' type

Apart from validating the character length of a field, you can also validate its type or validate it against a list. For example, you can specify that your `classYear` field needs to be an integer. You can also specify that weekday should not be Saturday or Sunday. To do that, update your validation requirements as follows:

```js
[
  // ... leave other validations untouched ...
  check('classYear', 'Class Year should be a number').not().isEmpty().isInt(),
  check('weekday', 'Choose a weekday').optional().not().isIn(['Sunday', 'Saturday']),
]
```

Now, after restarting the app, if you try to enter a value which is not an integer in the class year field, you will see an error message. Also, if you enter "Saturday" or "Sunday" in the weekday field, you will see the backend complaining.

### Validating and sanitizing emails

Express Validator also validates emails with the `isEmail()` function. Besides that, you can also make this library normalize emails with the `normalizeEmail()` function. In case you are wondering what it means to normalize an email, you can read about it in this [Stack Overflow post](https://stackoverflow.com/questions/27936705/what-does-it-mean-to-normalize-an-email-address).

In order to validate the email field, refactor the `check('email'` call in your code:

```js
[
  // ... leave other validations untouched ...
  check('email', 'Your email is not valid').not().isEmpty().isEmail().normalizeEmail(),
]
```

Then, after restarting the app, if you enter an invalid email on your homepage you will get an error message:

![Validating email addresses with Express Validator](https://images.ctfassets.net/23aumh6u8s0i/26cwBYI8B4AvRLMizfbUcV/57d5b927eb05c0ab024257c38a9607e9/email-error-messages)

### Sanitizing fields with trim and escape

With Express Validator, you can also trim away spaces from your data and escape special characters using the `trim()` and `escape()` functions. The `escape()` function can really come in handy when protecting yourself from cross-site scripting attacks. To add this feature to your app, refactor the call to `check('name')` as follows:

```js
[
  // ... leave other validations untouched ...

  check('name').exists().isLength({min: 5}).trim().escape().withMessage('Name must have more than 5 characters'),
]
```

To test this, the starter project came with code that prints every request body to the console after validation. So, imagine a malicious user types the following JavaScript code in your name field: `<script> alert("hello, there");</script>`. By using `escape` you will have no problem, as the name that you will get in your backend will look like:

```text
&lt;script&gt; alert(&quot;hello, there&quot;);&lt;&#x2F;script&gt;
```

That is, Express Validator transformed the malicious code into special HTML characters. Amazing, right?

### Validating with custom validators

Although Express Validator offers a bunch of solutions out of the box for you, chances are you will need to implement some custom validation. For example, imagine you need to make sure that the `password` field matches the `confirmPassword` field. To do that, you can use the `custom()` validation function as follows:

```js
[
  // ... leave other validations untouched ...

  check('confirmPassword', 'Passwords do not match').custom((value, {req}) => (value === req.body.password)),
]
```

The `custom` function takes in a function (an arrow function in this case) as an argument and checks if the `value` of the `confirmPassword` is the same as the value of the `req.body.password` field. To see this in action, restart your app, then enter a different password and you should get the message saying that "passwords do not match".

## Conclusion

In this article, you learned how to use the Express Validator middleware to validate and sanitize user data in an Express application. Guess what? You only scratched the surface of what is possible with Express Validator. Aside from learning more validation and sanitization functions, you can learn how to add wildcards to your validations, do schema validation and whole body validation from [Express Validator's documentation](https://express-validator.github.io/docs/). I will love to see what you build with Express Validator.

<include src="asides/AboutAuth0" />


Express Validator Tutorial

Multifactor authentication and social login are just two of several tools that Auth0 offers on its platform to guard its customers against breaches.



The number of attacks on individuals' data is astounding. From the [Equifax breach](https://www.washingtonpost.com/news/the-switch/wp/2018/03/01/equifax-keeps-finding-millions-more-people-who-were-affected-by-its-massive-data-breach/?noredirect=on&utm_term=.4bbb572bb730) that continues to worsen to attacks on high-tech companies like [Uber](https://www.wired.com/story/uber-paid-off-hackers-to-hide-a-57-million-user-data-breach/) — it seems as if no one is immune to cybercrime. 

Several common threats exist to web apps:

* XSS (cross-site scripting), when malicious scripts are injected into otherwise trusted web applications
* Clickjacking, which happens when an attacker introduces transparent or opaque objects into your web application
* Cross-site request forgery, in which an attacker impersonates an authorized user and makes requests on their behalf, like resetting a password.

And it doesn't stop there. These threats are constantly evolving. As soon as IT teams and experts root out dishonesty,  it seems like the criminals pivot to find a new path. 

So what can you do, now, to secure your user database in this difficult landscape?

<include src="TweetQuote" quoteText="What can you do to secure your user database when there are so many threats like XSS, Clickjacking, Cross-site request forgery, etc?"/>

This piece will offer concrete tools and approaches for keeping your customers safe and help you build a solid technical foundation on which to scale. 

## Why Is Your User Database At Risk?

A major reason that user databases are at risk is inherent software vulnerability. For example, Apache servers have historically been exposed to the [Heartbleed](http://heartbleed.com/) bug. Heartbleed is unique to OpenSSL (the data encryption technology used by a huge chunk of the internet) and allows attackers to intercept vulnerable information between one's browser and computer. 

If you're entering a password or payment information into a browser, for example, although this data will be encrypted during the transfer to the computer on one level; a second connection, often described as a “heartbeat” between the browser and computer can be intercepted.

![The heartbleed bug](https://images.ctfassets.net/23aumh6u8s0i/7bi6p1IFj7zJXCTzoN17S5/2dc69f99ed1d1efc1ce92a3c6738fdaf/the-heartbleed-bug)

([Source](https://www.youtube.com/watch?v=WgrBrPW_Zn4))

The Heartbleed bug manipulates the secret keys that the browser and computer use to encrypt the names and passwords of the users, along with other sensitive content. In vulnerable versions of OpenSSL software, hackers can break in and steal data directly from the services and users. You can read more about it on the [Heartbleed website](http://heartbleed.com/). 

### Why Not Just Patch The System?

If you find holes or vulnerabilities in your system, why not just fix them up and continue with business-as-usual? 

First, taking a user database offline creates downtime for a business. This can result in frustrated users who enjoy and rely on your service. Down the line, it can lead to a loss in revenue. 

Patching software is also risky. Particularly if you work with a lot of sensitive customer information, such as [financial transactions](https://auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/), making changes to a software library can break critical processes, leaving your users out to dry with payments incomplete and exposed. 

In some dire cases, such as a medical facility, it could truly be a matter of life and death if your system, full of patient data, shuts down (even temporarily). 

## A Better Solution: Secure Your User Database With Auth0 Identity Tools

Outsourcing your cybersecurity needs, particularly for a user database, can be an excellent solution. Only a few teams have the in-house capability to build and customize cutting-edge tools without support. Particularly if your company is constantly growing and changing as it should — you need to both brace your systems against attackers and make them flexible enough to allow you to scale. 

Auth0 has [several tools](https://auth0.com/why-auth0) to help you do this.

### Content-Aware MFA Technology

Amid the many features that Auth0 offers customers on its universal authentication and authorization platform, [multifactor authentication (MFA)](https://auth0.com/docs/multifactor-authentication) helps ensure that only the right users gain access to your system. Even if a hacker obtains a user's login credentials, s/he still needs a second piece of information, such as the user's thumbprint or mobile device, to make it through. 

It's simple to add MFA to your app. For example, if you want to add the Google Authenticator, which provides a six to eight digit one-time password to users as an alternate token, you can turn this on by first visiting Auth0's [Multifactor Auth](https://manage.auth0.com/#/guardian) page from the dashboard. 

![Auth0 multifactor authentication feature](https://images.ctfassets.net/23aumh6u8s0i/2ZuIZT9aZzbLGoaygmQljD/5704c74279f0f95fb04e3ee6de2ec85a/auth0-multifactor-authentication)

If you want to use a different provider like Duo, just click on the link to switch. You can then select if you want your users to receive the password via a push notification or SMS. 

While MFA is proven to reduce breaches of user databases, few organizations have successfully integrated it. Why? Making the 2FA setup simple for customers is a challenge. Even advanced services like [PayPal](https://www.paypal.com/us/smarthelp/article/how-do-i-enable-2fa-(two-factor-authentication)-for-my-paypal-powered-by-braintree-user-faq3500) have made users opt-in through a lengthy process that entails their first logging into a control panel, navigating to their account, and then independently enabling 2FA with a QR code or another supported app.

Auth0 can help you figure out ways to integrate and communicate MFA capabilities for your users in a more seamless and self-aware way. Visit our [business blog](https://auth0.com/blog/business/) for further resources.

### Social Login Integrations

You can also build robust profiles of all of your users using Auth0's [social login functions](https://auth0.com/learn/social-login/). Social login allows users to register and access your app by connecting via a provider like Facebook.

Auth0 supports over 30 social providers, including Facebook, Twitter, Google, Yahoo, Windows Live, LinkedIn, GitHub, PayPal, Amazon, VKontakte, Yandex, Basecamp, Box, Salesforce, and more.

![Auth0 social login integrations](https://images.ctfassets.net/23aumh6u8s0i/3SndDrKq0SuzoeXOcEt6Bb/08882aef7d9d6b36f48aa6d516b5300f/auth0-social-login-integrations)

In addition, you can add any OAuth2 Authorization Server you need. To enable social login, just click Connections and then Social in the Auth0’s Management Dashboard, then flip on the switch of the social network provider you'd like in the app(s) of your choice.

The advantages of social login are numerous. A few are:

* You know your users are verified since the social provider is already responsible for verifying the user’s email. 
* If you want to double check an individual, you can immediately access information such as their interests, location, connections, and more to make sure the account is real. 
* This data can also go a long way towards underpinning new marketing and product tactics.

You can take this a step further and build even richer customer profiles by integrating with a provider like [Clearbit](https://blog.clearbit.com/avoid-tedious-signup-forms-with-auth0-and-clearbit/). Clearbit sharpens customer intelligence, allowing teams access to valuable public information that can help them outperform.

## Why Auth0?

Outsourcing your user database needs allows you to turn over these critical tasks to experts, who are up-to-date on the latest trends and are keeping pace with evolving threats. An identity services provider like Auth0 doesn't have to balance these tasks with regular maintenance projects like most IT teams do. 

<include src="TweetQuote" quoteText="Outsourcing your user database needs allows you to turn over these critical tasks to experts, who are up-to-date on the latest trends and are keeping pace with evolving threats."/>

Auth0's user database tools support all major industry standards such as SAML, OpenID Connect, JSON Web Token, OAuth 2.0, OAuth 1.0a, WS­-Federation and OpenID, preventing vendor lock-in.

If you're looking for a quick solution to help you come into [GDPR](https://auth0.com/gdpr) compliance — as part of a larger customer identity and access management (CIAM) platform — MFA and Social Login will support your getting there in an efficient manner.

If you are just starting out or [modernizing](https://auth0.com/app-modernization) legacy apps from years of prior use, integrating tools to protect user identities from the outset will build a solid foundation for your products for years to come.


Use Auth0 Tools To Securely Manage Your User Database

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Key solutions like anomaly detection, universal login, and custom security rules delivered by Auth0 helps its customers protect sensitive user data.



Tight infrastructure security is critical — but if you don't remember to secure your web applications, customer data remains exposed.

There are several [common threats to web-app security](https://auth0.com/blog/common-threats-in-web-app-security/):

- A lack of encryption between your web browser and their servers
- XSS (cross-site scripting) that occurs when malicious scripts are injected into web applications
- Clickjacking (when an attacker injects transparent or opaque objects into a web application)
- Cross-site request forgery (where the attacker impersonates an authorized user and requests sensitive information, such as passwords)

These threats are continuing to multiply and become more complex by the day. To mitigate breaches, particularly in a time of [heavy regulatory scrutiny](https://auth0.com/docs/compliance/gdpr), Auth0 offers three major strategies:

1.  Anomaly Detection
2.  Universal Login Support
3.  Customizable Rules

Auth0 allows you to combine these features to further amplify protection for your app's end users. While you can always attempt to develop these and similar solutions in-house, outsourcing app security will give you access to a team of experts who work 24/7 to keep up with the latest trends in a constantly evolving space.

## Anomaly Detection

Auth0 provides three built-in shields that [detect anomalies](https://auth0.com/docs/anomaly-detection) among users in an app's system. Used separately or in combination, the shields have the ability to stop malicious access attempts before they occur. Administrators receive alerts of suspicious activity and can then block future login attempts by an aberrant user.

<include src="TweetQuote" quoteText="Learn more about how Auth0 provides three built-in shields that detect anomalies among users in an app's system."/>

### Brute-Force Protection

Within its [Brute-Force Protection](https://auth0.com/docs/anomaly-detection) feature, Auth0 has two distinct shields:

1.  Shield 1 is triggered after 10 failed login attempts on a single account from the same IP address.
2.  Shield 2 is triggered after 100 failed login attempts from a single IP address via different usernames in 24 hours or after 50 sign-up attempts in one minute from the same IP address.

When Shield 1's threshold is reached, an email is automatically sent to the user, which an administrator can edit however he or she wishes. This initial email looks like:

![Affected user email](https://images.ctfassets.net/23aumh6u8s0i/7Hf4QzvX6IDVi6gl4hGRp4/8fc62d71de2ae3698d64c087b89c730c/affected-user-email)

An administrator can easily edit the template by accessing the Auth0 [Dashboard](https://auth0.com/docs/dashboard) and following Emails > Templates.

When Shield 2 is triggered, dashboard administrators are notified. Brute-Force Protection will also block the suspicious IP address. When the issue is resolved, an administrator simply locates the user in the Auth0 [Dashboard](https://auth0.com/docs/dashboard) and files an action to unblock. A user can also click on the "unblock" link provided in the email above or change their password.

### Breached-Password Detection

The third shield is breached-password detection. This is easy to turn on and customize in the Anomaly Detection section of the Auth0 dashboard.

![Breached-password anomaly detection with Auth0](https://images.ctfassets.net/23aumh6u8s0i/3Oe0VufANczOhCpPtuL8iV/99ffa473077e16cd7733334c25a9c73d/breached-password-shield)

Breached-password detection is useful in instances where Auth0 suspects that a user's email has been compromised in a major security breach. (Auth0 consistently tracks these on third-party sites.) If this occurs, Auth0 will trigger the shield, notify the user, and block them from logging in until they reset their information. Breached-password detection is becoming increasingly helpful as many individuals use the same or similar iterations of the same password on multiple sites.

<include src="TweetQuote" quoteText="When Auth0 suspects that a user's email has been compromised in a security breach, Auth0 will trigger a protective shield, notify the user, and block them from logging in until they reset their information"/>

## Universal Login

Auth0 supports [universal login](https://auth0.com/blog/authentication-provider-best-practices-centralized-login/) on customer apps. In contrast to embedded login, this offers increased security and a shorter setup time.

![Auth0 Universal Login offerings](https://images.ctfassets.net/23aumh6u8s0i/21BR2xIUfU721nga9W1FqO/184597f0a961d89938bb9923b08e6a73/centralized-embedded-diagram)

Universal login is a more seamless experience for the user. On the front end he or she sees a simple authentication request; on the back end, credentials remain within the same domain instead of being sent across origins. This makes it a far more secure method than exposing the information to outside sources. When personal data moves from one origin to another, [phishing attacks](https://auth0.com/blog/all-you-need-to-know-about-the-google-docs-phishing-attack/) and [man-in-the-middle attacks](https://auth0.com/docs/security/common-threats#man-in-the-middle-mitm-attacks) become common.

In addition to an enhanced customer experience, universal login is simpler for administrators to maintain and provides the benefits of single sign-on (SSO).

## Auth0 Security Rules

Auth0 has developed customizable [Rules](https://auth0.com/docs/rules/current) for its app-security features. Rules are JavaScript functions that execute when a user authenticates to your application. Rules can be helpful when customizing and extending Auth0's existing capabilities. For example, the [Force Email Verification](https://auth0.com/rules/email-verified) and [User Fraud Score](https://auth0.com/rules/socure_fraudscore) Rules can be incorporated into Auth0's existing tools like Anomaly Detection to better determine if a user truly is who they say they are.

### Force Email Verification

Force Email Verification only allows app access to users who have verified their emails. Incorporating Force Email Verification into an app instead of a browser version is a good UX practice with powerful back end capabilities.

![Force Email Verification code](https://images.ctfassets.net/23aumh6u8s0i/6MhbfE6DYpGdnku3wGI9Rn/4dd87042b24817242ccde8b52d16c781/verify-email-code)

[[Source](https://auth0.com/rules/email-verified)]

For example, if you are working with a large set of emails that belong to a network, e.g., `@university.edu` or `@company.edu`, Force Email Verification can help parse individuals in a group to make sure that a fake user hasn't set up an account to blend in with the others. Force Email Verification requests that users cross-check their information; anyone who returns information that doesn't match or does not return additional information at all will be blocked from logging in.

### User Fraud Score

Like Force Email Verification, you can tack on the User Fraud Score to a variety of features. If you've built an online marketplace — like Etsy, for example — you can use this rule to cross-check everyone conducting business and thus add an extra layer of protection to purchases. The Rule calculates a fraud score for every user, based on their email address and IP address.

```javascript
function (user, context, callback) {
  // score fraudscore once (if it's already set, skip this)
  user.app_metadata = user.app_metadata || {};
  if (user.app_metadata.socure_fraudscore) return callback(null, user, context);

  if(!user.email) {
    // the profile doesn't have email so we can't query their api.
    return callback(null, user, context);
  }

  const request = require('request');

  // socurekey=A678hF8E323172B78E9&email=jdoe@acmeinc.com&ipaddress=1.2.3.4&mobilephone=%2B12015550157
  request({
    url: 'https://service.socure.com/api/1/EmailAuthScore',
    qs: {
      email:  user.email,
      socurekey: configuration.SOCURE_KEY,
      ipaddress: context.request.ip
    }
  }, function (err, resp, body) {
    if (err) return callback(null, user, context);
    if (resp.statusCode !== 200) return callback(null, user, context);
    const socure_response = JSON.parse(body);
    if (socure_response.status !== 'Ok') return callback(null, user, context);

    user.app_metadata = user.app_metadata || {};
    user.app_metadata.socure_fraudscore = socure_response.data.fraudscore;
    user.app_metadata.socure_confidence = socure_response.data.confidence;
    // "details":[
    //     "blacklisted":{
    //        "industry":"Banking and Finance",
    //        "reporteddate":"2014-07-02",
    //        "reason":"ChargeBack Fraud"
    //     }
    // ]
    user.app_metadata.socure_details = socure_response.data.details;

    auth0.users.updateAppMetadata(user.user_id, user.app_metadata)
      .then(function(){
        context.idToken['https://example.com/socure_fraudscore'] = user.app_metadata.socure_fraudscore;
        context.idToken['https://example.com/socure_confidence'] = user.app_metadata.socure_confidence;
        context.idToken['https://example.com/socure_details'] = user.app_metadata.socure_details;
        callback(null, user, context);
      })
      .catch(function(err){
        callback(null, user, context);
      });
  });
}
```

In the Auth0 Dashboard, copy the code block above, and replace placeholders with the appropriate values. The rule will pull the fraud score from socure.com and store it on app_metadata. A full set of Auth0 Rules can be found [here](https://auth0.com/docs/rules/current).

For fraud detection, Auth0 partners with [ThisData](https://auth0.com/blog/anomaly-detection-safer-login-with-thisdata-and-auth0/). ThisData allows real-time detection of any account takeovers across both web and mobile apps.

## No Better Time To Secure Your Apps

Securing your app with the best tools is always a good decision — but it is especially timely, given the slew of new regulations: GDPR deadline has passed, but [it's not too late to comply](https://auth0.com/blog/your-quick-gdpr-compliance-checklist/), and several countries and states in the U.S. have followed the EU with [similar privacy initiatives](https://auth0.com/blog/brace-yourself-the-gdpr-ripple-effect-in-california/). In line with these events, Auth0 has developed additional [strategies](https://auth0.com/gdpr-assessment/) for getting your team into alignment quickly, including [customer identity and access management (CIAM) protocol](https://auth0.com/blog/digital-success-through-customer-identity-and-access-management/).

While it might be easy to forget your apps in the swirl of demands around your core operations — making sure you plug any holes here is key to ensuring that you don't become another [data-breach statistic](https://consequenceofsound.net/2018/06/ticketfly-hacker-data-breach/).


How Auth0 Makes Your Apps More Secure

Tips for a secure and organized data migration process. 1. Workflow and project management tools 2. User identity and access management 3. Clear customer communication



Data is the foundation of a company's success. It provides the basis for customer insights, corporate strategy, and operational efficiency. As more companies embark on [digital transformation](https://auth0.com/app-modernization), migrating this critical information — particularly sensitive customer data — to a new platform(s) can be a burden. Moving data can unearth inaccuracies, unknowns, and/or duplicate entries, making it insufficient to use and requiring significant changes. 

The tips below will help ensure that the movement of your most sensitive information is secure, organized, and accessible to your users.

<include src="TweetQuote" quoteText="Data is the foundation of a company's success. This post will help ensure that the movement of your most sensitive information is secure, organized, and accessible to your users!"/>

---

## Issues That Can Arise with Data Migration
Before we dig into strategies for success, it's important to understand the issues that can arise in data migration. The process can be thorny for several reasons.

### Lack of Consideration for the Process
Teams are generally focused on selecting and configuring their new system. Testing potential tools and comparing the models are generally more exciting and inspiring than the mechanics of lifting data out of the legacy package. If data is uploaded in its current state, any errors or irrelevant aspects could become amplified and increase the information's exposure to risk. Because of this, it's important to be sure your team is on the same page about the nuances of the process and has a specific roadmap marked with individual roles and responsibilities.

### Improperly Tracking Users
It's critical to manage user identities and monitor for suspicious activity when you're migrating sensitive information. Companies that rely on consumer data, in particular, must validate all entries against new regulations — [GDPR](https://auth0.com/docs/compliance/gdpr/features-aiding-compliance/protect-user-data), for example, along with more specialized industry standards such as Sarbanes-Oxley (SOX) for financial institutions and the Health Insurance Portability and Accountability Act (HIPAA) for many healthcare providers.

### Poor Communication of Updates
Making sure your end users understand how you are securing their data after you've updated your apps is important for maintaining their trust. If you can't articulate what you are doing with their information, it's unlikely they will stick around. Documenting your work and developing a clear communication strategy are essential to making sure your data migration supports your company's overall goals for growth.

To address these potential issues, the following strategies focus on workflow, user access, and communications.

<include src="ebook-ads/UserMigrationYourWay" />

## 1. Organize Your Workflow and Project Management
To clearly understand and outline the steps required for a successful data migration, take time to consider the following:

- What will cause the least disruption to the daily operations of your system? That is, when are the best times to work on and/or migrate data sets of highest sensitivity or usage?
- What aspects of your strategy can you tag to teammates in-house, and where might you need to bring in outside expertise?
- How will you document your process, ensuring that all information is accounted for?
- Will you enrich your files after they have been moved with further information (e.g., customer names and/or account numbers)?

While this list is not exhaustive and each strategy will be unique, depending on an organization's current systems and future goals, it should aid in understanding the depth of thought required for an efficient data migration.

It can be helpful to use a workflow tool to organize your team and define your process. [Airtable](https://airtable.com/product) has a proven track record for improving internal organization. When mapping out your data migration strategy, Airtable can help define your project scope, set deadlines, and assign individual responsibilities.

For any task that you're organizing, Airtable will help prioritize tasks and ensure that you adhere to your overall goals:

![Airtable](https://images.ctfassets.net/23aumh6u8s0i/38brOxQrTQvBu8Pa8BBQ17/df355af7ec95291c2abff6758ccb9694/1-airtable)

> [Source.](https://airtable.com/product)

Within the grid view, you can check to see which tasks have been completed and quickly note whom to reach out to in case of a question or concern. Airtable also has a [calendar view](https://airtable.com/product) to better visualize the timeline of your data migration, which can quickly become lengthy and arduous without clear monitoring. Both views can help break down the potentially opaque data migration process into a concrete series of steps.

Additional tools to consider for managing the task of data migration include:

- [Asana](https://asana.com/guide/examples/company/project-management): Highly customizable, popular tool for engineering teams
- [Trello](https://trello.com/): Visual workflow; bulletin-board format
- [Jira](https://www.atlassian.com/software/jira): Supports distributed collaboration

Taking time to think through your steps at a granular level and selecting a tool that will hold your team accountable will help you succeed.

## 2. Clearly Track Who Accesses Customer Data
Understanding who is accessing and updating portions of sensitive customer data at any given time during the data migration process is critical to maintaining integrity. In today's environment of [increasing industry regulations](https://auth0.com/gdpr) around consumer data, this core function must be up-to-date and as tight as possible. 

Because of the complexity and urgency of this task, many teams choose to outsource their [identity management](https://auth0.com/app-modernization) when migrating data, particularly as part of a larger [digital transformation](https://auth0.com/learn/identity-management-drives-digital-transformation/).

[Auth0's user management dashboard](https://auth0.com/b2e-identity-management-for-employees) allows a systems administrator to authorize new users, track their behaviors, and evaluate their performance according to the company's policies.

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/5IwuLEHPTS1w1q7UhTcUPk/277cb0224267a945a4265e0984263142/2-auth0-manage)

> [Source.](https://auth0.com/learn/cloud-identity-access-management/)

In the Auth0 dashboard, an administrator will have a clear view of users at any point. In addition, Auth0's identity platform offers enhanced options like multi-factor authentication, anomaly detection, and advanced logging. For example, if the administrator notices a certain user has a series of failed login attempts, they can [block access](https://auth0.com/docs/anomaly-detection) to investigate further. 

From a user perspective, this function is an invisible and painless part of their workflow. 

## 3. Explain Your Data Policy Changes
If you can clearly communicate your data migration and updated data usage policies to your users, you will gain their trust — and an edge over your competitors. At the moment, very few company blogs or statements spell out the details of data usage in a digestible format — as we've recently seen with Facebook's [confusing policies](https://www.wired.com/story/mark-zuckerberg-congress-day-one/). 

You have an enormous opportunity to distinguish yourself in the field if you can fill this information gap. A major data migration is a perfect opportunity for you to document previous work and latest updates. Making this information immediately visible, user-friendly, and clearly accessible is key:

![Facebook](https://images.ctfassets.net/23aumh6u8s0i/7mn6vdZtybE6e5Rlg1dSNa/10c9a53747ac05ec8598251b03153990/3-zuck)

> [Source.](https://www.recode.net/2018/3/28/17171496/facebook-settings-redesign-cambridge-analytica)

While hopefully your team will not be recovering from a data leak like [Facebook's](https://auth0.com/blog/cambridge-analytica-and-facebook/), the tech titan provides an excellent example of how to communicate a change in policy to users. Three key points to include when explaining your updates are:

1. Place a brief summary of the information on the front of the app where users will see it immediately without any digging.
2. Include a clear CTA or way in which users can click to read further details.
3. Make sure any actions your user must take to delete or update their data settings are very simple.

You must make your user feel as though they are well supported and in full control. Both sets of information — your summary and fine print — should feel friendly and encouraging. Employ your best writers and incorporate welcoming images or a set of bullet points to truly put your best foot forward.

## Don't Be Afraid to Change
[90%](https://auth0.com/learn/how-auth0-uses-identity-industry-standards/) of businesses today state that legacy software systems are keeping them from achieving their goals. Despite increasingly strict regulations, you should not be afraid to scale and innovate. Just be sure you take the process of data migration seriously as you search for your new platform. Make sure the right people access the correct pieces of data at the proper times during the migration and then seize the opportunity to demonstrate how bulletproof your new strategy is with excellent customer communications.

<include src="TweetQuote" quoteText="90% of businesses state that legacy software are keeping them from achieving their goals. Scale and innovate while paying attention to data migration to succeed!"/>


Three Strategies to Streamline Your Data Migration Process

Recent breach affecting up to 711M email addresses shows critical need for protection and detection.


No business is immune to the threat of breached passwords and devastating hacks. We’ve seen it one too many times with the [largest businesses](https://auth0.com/blog/data-breaches-by-the-numbers/) in the world falling victim to database leaks — Yahoo, eBay, Target, and most recently, [Equifax](https://auth0.com/blog/equifax-data-breach/), possibly one of the largest breaches in history. Cyber criminals hacked into the Equifax database, stealing names, social security numbers, birth dates, addresses, and private information of up to **143M people**. As a result, Equifax now faces a [multibillion dollar lawsuit](https://www.bloomberg.com/news/articles/2017-09-08/equifax-sued-over-massive-hack-in-multibillion-dollar-lawsuit) for its negligence. 

There’s no denying that the impact of any database hack is crushing, both financially and for customer trust. 

![Breached Passwords Counter](https://images.ctfassets.net/23aumh6u8s0i/nl4nXGra5tATBOdRghumc/73b8bcd18df0b9091596065dc65c4407/counter)

Another alarming breach was recently uncovered: a new, highly sophisticated spambot called **Onliner** that has infiltrated systems worldwide, targeting a whopping **711M email addresses**. Troy Hunt, a Microsoft developer, well-known security researcher and creator of [haveibeenpwned.com](https://haveibeenpwned.com/) (HIBP), outlined the insidious nature of this spambot in a [recent blog post](https://www.troyhunt.com/inside-the-massive-711-million-record-onliner-spambot-dump/) that highlights the diversity of the data that was breached. Notable examples, like: 

* 29m rows of email address and password pairs 
* 142k email addresses, passwords, SMTP servers and ports
* Random selection of a dozen different email addresses checked against HIBP showed that *every single one of them* was in the LinkedIn data breach
* 4.2m email address and password pairs, this time with every single account having a hit on [the massive Exploit.In combo list](https://www.troyhunt.com/password-reuse-credential-stuffing-and-another-1-billion-records-in-have-i-been-pwned/)

Millions of emails and passwords are compromised every day, as clearly evident by Onliner, and yet there is a very simple solution that can avert this cyber-crisis or dramatically mitigate its disastrous effects: **[Breached Password Detection](https://auth0.com/breached-passwords).** 

![Breached Passwords Getty-Image](https://images.ctfassets.net/23aumh6u8s0i/3JUrz8QhYuyUFzA1I4584m/344c41f0fc27bfcbbed415972ba7c5e1/secondary)

##Breached Password Detection
Auth0’s Breached Password Detection just celebrated its [one-year anniversary](https://auth0.com/blog/announcing-password-breach-detection/), and in the past year alone has protected millions of passwords. Our continuously-updated database of breached credentials containing hundreds of millions of entries serves as the clearinghouse for the legitimacy of any password-based logins. Any matches are denied and blocked in real-time; and users are instantly alerted to the attempt, forcing them to change their passwords immediately. 

Breached Password Detection is a crucial feature in our identity platform that is used by our [global customers](https://auth0.com/customers) for safeguarding valuable data. Here are compelling stats: 

* Thus far in 2017, our database has identified 3,602,290 instances of detection
* And from September 2016 to now, that tally increases to 3,951,160
* Auth0’s Breached Password Detection database averages 450,286 blocked breached passwords per month and 14,885 per day 

It’s a foolproof way to ensure you’re protecting your assets, and that of your customers. 

Implementing this essential measure is seamless on our authentication platform and requires simply toggling the feature on. Simple. 

This level of protection, bolstered by additional Auth0 measures like [Single Sign On](https://auth0.com/learn/how-to-implement-single-sign-on/) and [Multifactor Authentication](https://auth0.com/multifactor-authentication), makes your [service more secure](https://auth0.com/blog/5-ways-to-make-your-app-more-secure-in-less-than-20-minutes/), but more importantly, builds customer trust that’s beyond measure. 

What are you waiting for? 

Try Auth0 for free today to learn more about how you can protect your data and customers with Breached Password Detection.



Breached Password Detection: Protect Your Users’ Data Before It’s Too Late

Authentication increases security of user data and provides scalable platform to continue growth in booming industry



**BELLEVUE, WA**—[Auth0](https://auth0.com), the leading Identity-as-a-Service (IDaaS) platform, is providing authentication to [Battlefy](https://battlefy.com/), an eSports management platform, to continue establishing its leadership in the rapidly-growing eSports industry. As part of a burgeoning market, expected to reach $1B by 2020, Battlefy has already organized more than 75,000 events at college clubs and national organizations around the country. Battlefy was in need of an easy-to-implement authentication platform that would provide increased security and a better user experience.

Rather than create authentication from scratch, Battlefy realized how much more time and cost-efficient it would be to implement Auth0 from the ground up. Auth0 provided the flexibility, extensibility, and security Battlefy was seeking, and quickly helped them achieve one major priority of eliminating sensitive user-private information from their own database.

“Auth0 is really the only identity service provider. We turned to them to replace existing social logins and gain the ability to remove password hashes from our database,” said Ronald Chen, Senior Software Developer, Battlefy. “They have great documentation, an easy-to-use API, and a great administrator panel.”

The implementation took less than a month and has given Battlefy a much more secure and seamless user experience. It also provided the company with the internal security it needs for its management tool that is accessed by Battlefy employees around the world. Due to the success of the implementation, Battlefy is assessing other ways to use Auth0, possible providing authentication to smaller companies who don’t have their own servers or infrastructure.

<include src="asides/AboutAuth0" />


Battlefy is Major Player in eSports Arena with Help From Auth0

How to collect, send and analyze your user data for growth



## Intro

Companies that want to make data-driven decisions know they need to learn as much about their users as they can.

But great companies know that the best way to get that data is not by asking — it's by building a funnel to collect what's already out there quickly and efficiently.

That's why social login is one of the most powerful analytics tools. With the option to log into your app using a social media account they've already set up, users save themselves the annoying step of creating a new username & password combination. And you save them the effort of telling you who they are.

> Auth0 can help B2C companies to enrich the profile of their customers through an easy to use [Modern Customer Identity Management solution](https://auth0.com/b2c-customer-identity-management).

With a few simple tools and pieces of code, you can use the information they've made publicly available to make better decisions about your marketing, product development, and user retention.

Let's go step-by-step through what you need to start using your user data better, from signup and login to analysis.

## 1. Set up social login

The first thing you have to decide is what kinds of social media platforms you want to support with your social login.

![Auth0 social login providers](https://images.ctfassets.net/23aumh6u8s0i/3q11XLTm7JG97Zui0NdS83/69c34978d5b60a9fbfaceb42459b0334/enabling-social-connections)

Auth0 [can automatically reconcile](https://auth0.com/learn/social-login/) the different headers and response formats of different social APIs, so as the developer you don't need to think about which you (technically) can and can't enable.

What you should think about are the kinds of social profiles that *your* users want to use.

Both in terms of popularity and data accessibility, both Facebook and Google are sure bets. The two of them together represent [more than 3/4](https://auth0.com/blog/analysis-of-social-connection-data/) of all social logins on the web. If you're working on a fundamentally social app — messaging, communication, entertainment — it would be hard to avoid putting them on your site.

![Social connections share per provider](https://images.ctfassets.net/23aumh6u8s0i/3vNr6zEmmR9W9U0j52Mm0E/cbc264516146f645308b16d47edfda78/social-connections-usage)

But if you're working on anything specialized — from developer tools, to marketing & sales, to file-sharing — there are going to be other, better options for getting the best kind of user data.

Imagine pulling info on all of a dev's repositories and commits from their Github or Bitbucket profile, or automatically integrating all of a user's Dropbox uploads into your teamwork collaboration tool.

Imagine pulling your new signup's social graph so you can show them all their friends using your platform, or immediately give them content that they can start interacting with.

The social logins you support shouldn't just make it easier for people to login — they should integrate with platforms that will help you build a better user experience.

## 2. Set up rules

The kind of information you collect is going to vary depending on how you want to use the data and the platforms you're collecting it from, but you'll collect it in the same way regardless.

Let's say your users are signing up with your Twitter social login option and you want to collect what country is the user in. All collection in Auth0 is done through [Rules](https://auth0.com/docs/rules) — snippets of Javascript executed on the backend every time a user is authenticated.

![Auth0 rules](https://images.ctfassets.net/23aumh6u8s0i/3X9mYmKdLN5YJIpXikBfOZ/38fc334ebbd71a1a4112ade6ab5cf6ba/rules-diagram)

If you wanted to collect the current country from all users logging in through Twitter, you'd set up the [add country to the user profile Auth0's Rule](https://github.com/auth0/rules/blob/master/rules/add-country.md) and then use this line of code to get the country:

```javascript
var country = user.country;
```

Using Auth0's [Segment Rule](https://github.com/auth0/rules/blob/master/src/rules/send-events-segmentio.js), you could then send that data to [Segment](https://segment.com/) and then to the email marketing tool of your choice:

```javascript
function (user, context, callback) {
  if (context.protocol === 'delegation') {
    return callback(null, user, context);
  }

  const request = require('request');

  if (context.stats.loginsCount > 1) {
    sendEvent('Logged in');
  } else {
    sendEvent('Signed up');
  }

  function sendEvent(e) {
    const sioTrack = {
      userId: user.user_id,
      event: e,
      properties: {
        application: context.clientName
      },
      context: {
        ip: context.request.ip,
        userAgent: context.request.userAgent
      }
    };

    // Segment API returns 200 OK for all its request. For possible errors
    // you must use Segment's Debugger (https://segment.com/docs/libraries/http/#errors)
    request({
      method: 'POST',
      url: 'https://api.segment.io/v1/track',
      headers: {
        'Content-type' : 'application/json',
        'Authorization': 'Basic ' + Buffer.from(configuration.SEGMENTIO_WRITE_KEY + ':').toString('base64')
      },
      body: JSON.stringify(sioTrack),
    });
  }

  callback(null, user, context);
}
```

You could use additional rules to collect each user's [estimated median income](https://github.com/auth0/rules/blob/master/rules/add-income.md) (based on their IP address's zip code), link accounts with the [same email address](https://github.com/auth0/rules/blob/master/rules/link-users-by-email.md), and more.

## 3. Analyze and use your data

Auth0, as a clearing house for all user authentication in your app, can operate as a single source of truth for user data. When data is being drawn from discrete user identities, with Rules being executed on the backend, there's no risk of errant tags or false positives.

That makes Auth0 particularly suited for analysis that demands a high level of precision. Imagine you want to [segment all your users](https://auth0.com/learn/customer-loyalty-program/) by age, income, gender, region, interests, and marital status in order to analyze who should receive a pre-launch email announcing a new coupon code.

With social login, enriching your user profiles with that kind of data is painless. And there are endless applications for this kind of enrichment:

* **Personalized onboarding**: If everyone from product managers to marketers is using your SaaS product, use role attribution to send people to onboarding flows designed for their specific needs.
* **Retention analysis**: Segment your user base by activity and look at what kinds of users tend to stick around the longest, who takes the most advantage of your app, and who you should be trying to re-engage.
* **Building customer personas**: Grouping your customers into representative personas is a powerful way to focus your marketing and product development efforts. But you don't need to do it all by intuition when you can use analytics to build quantitative models of who your users are, where they come from, and what they do.

Auth0 users can use our pre-built Rules to send user information to a variety of applications. Besides that, we have recently released a product called [Auth0 Extend](https://auth0.com/extend/). This product enable companies to provide to their customers an easy to use extension point that accepts JavaScript code. With [Auth0 Extend](https://auth0.com/extend/), customers can create custom business rules, scheduled jobs, or connect to the ecosystem by integrating with other SaaS systems, like Marketo, Salesforce, and Concur. All using plain JavaScript and NPM modules.

### Slack

![Slack logo](https://images.ctfassets.net/23aumh6u8s0i/3FBbv0miQbV6ajzFeflMSF/b7e8bf323c2359cdc97b94a5d0db016e/slacklogo)

[Slack](http://slack.com/) is more than a communication tool. With the right integrations, it can become more like a hub for all your critical business activities.

You can notify all users of a Slack channel of your choice with our [Slack Rule](https://github.com/auth0/rules/blob/master/rules/slack.md):

```javascript
function(user, context, callback) {
  // short-circuit if the user signed up alreadyif (context.stats.loginsCount > 1) return callback(null, user, context);

  // get your slack's hook url from: https://slack.com/services/10525858050var SLACK_HOOK = 'YOUR SLACK HOOK URL';

  var slack = require('slack-notify')(SLACK_HOOK);
  var message = 'New User: ' + (user.name || user.email) + ' (' + user.email + ')';
  var channel = '#some_channel';

  slack.success({
   text: message,
   channel: channel
  });

  // don’t wait for the Slack API call to finish, return right away (the request will continue on the sandbox)`callback(null, user, context);
}
```

###   Mixpanel

![Mixpanel logo](https://images.ctfassets.net/23aumh6u8s0i/7Eh1Ul4ndgBu5SIJiDVc7Q/14e22613eb16bc4eae46f3ece65a8ec2/Mixpanel)

[Mixpanel](https://mixpanel.com/) is an analytics provider that allows you to look at user behavior in both mobile and web applications. You can look at how specific features in your app are performing, what sets apart the users who come back to your app day in and day out from those who don't, and more.

The [Rule](https://github.com/auth0/rules/blob/master/rules/mixpanel-track-event.md) below sends a `Sign In` event to Mixpanel every time a unique user logs into your app. Check out Mixpanel's [HTTP API](https://mixpanel.com/help/reference/http) for more information.

```javascript
function (user, context, callback) {

  var mpEvent = {
    "event": "Sign In",
    "properties": {
        "distinct_id": user.user_id,
        "token": "{REPLACE_WITH_YOUR_MIXPANEL_TOKEN}",
        "application": context.clientName
    }
  };

  var base64Event = new Buffer(JSON.stringify(mpEvent)).toString('base64');

  request.get({
    url: 'http://api.mixpanel.com/track/',
    qs: {
      data: base64Event
    }
  }, function (e, r, b){
      // don’t wait for the MixPanel API call to finish, return right away (the request will continue on the sandbox)
      callback(null, user, context);
  });
}
```

### Fullcontact

![Fullcontact logo](https://images.ctfassets.net/23aumh6u8s0i/5xAKnaWPGMi374xPXDh8VV/9b7b2a6c9b43197bed0c805de9262154/fullcontact-logo)

[FullContact](https://www.fullcontact.com/) is contact management software that's used to unify, de-dupe and clean lists of contacts — a big pain point for sales and marketing - heavy organizations, not to mention media companies.

Our FullContact [Rule](https://github.com/auth0/rules/blob/master/rules/get-FullContact-profile.md) allows you to get a user's profile from FullContact using their email address. It'll add a `fullContactInfo` property to their `user_metadata` if their information is available. For more, see the [FullContact API docs](http://www.fullcontact.com/developer/docs/).

```javascript
function (user, context, callback) {
  var FULLCONTACT_KEY = 'YOUR FULLCONTACT API KEY';
  var SLACK_HOOK = 'YOUR SLACK HOOK URL';

  var slack = require('slack-notify')(SLACK_HOOK);

  // skip if no email
  if(!user.email) return callback(null, user, context);
  // skip if fullcontact metadata is already there
  if(user.user_metadata && user.user_metadata.fullcontact) return callback(null, user, context);
  request({
    url: 'https://api.fullcontact.com/v2/person.json',
    qs: {
      email:  user.email,
      apiKey: FULLCONTACT_KEY
    }
  }, function (error, response, body) {
    if (error || (response && response.statusCode !== 200)) {

      slack.alert({
        channel: '#slack_channel',
        text: 'Fullcontact API Error',
        fields: {
          error: error ? error.toString() : (response ? response.statusCode + ' ' + body : '')
        }
      });

      // swallow fullcontact api errors and just continue login
      return callback(null, user, context);
    }


    // if we reach here, it means fullcontact returned info and we'll add it to the metadata
    user.user_metadata = user.user_metadata || {};
    user.user_metadata.fullcontact = JSON.parse(body);

    auth0.users.updateUserMetadata(user.user_id, user.user_metadata);
    return callback(null, user, context);
  });
}
```

There are endless ways to use customer data to build a better application. The key is to keep experimenting until you find something that really works — when you find that, double down.

There are no magic bullets. All you can do is look for an edge. Using analytics, however, you can find that edge a lot faster.

> [Auth0 offers a generous **free tier**](https://auth0.com/pricing) to get started with modern authentication on B2C, B2B, retail and CIAM products.


How To Build Your User Analytics Funnel With Social Login

7752008352217db815996ab04aec46e6?s=80 avatar

7752008352217db815996ab04aec46e6?s=80

Matias Quaranta

Learn how to integrate Azure DocumentDB as your Auth0's custom user database and take advantage of this blazing fast cloud NoSQL database service.



---

**TL;DR:** In this article you will learn how to integrate Auth0 with the fast and scalable Azure DocumentDB as a custom database connection and use it in your Auth0 applications.

---

Auth0 offers a highly performant and secure user store to maintain your users’ profiles. It is also a common solution if you want to **store** your users’ login information in your **own database** where you keep all of your application's data; in this case, Auth0 provides you with several identity providers you can use to **integrate**. One such database is **Azure DocumentDB**, a blazing-fast **NoSQL** service for highly available and globally distributed applications.

During this article, we will guide you into **integrating Auth0 and Azure DocumentDB** so your users' profiles are stored on your cloud NoSQL database.

## Authentication integrated

Let’s start by noting the **diversity** of custom database identity providers that Auth0 supports.

This list includes MySQL, Sql Server (both on-premises and on Azure), PostgreSQL, ASP.NET Membership Providers, any Basic Auth web service and **MongoDB**. We will focus on this last one since Azure DocumentDB now supports the [MongoDB protocol](https://azure.microsoft.com/documentation/articles/documentdb-protocol-mongodb/).

![Auth0 custom providers list](https://images.ctfassets.net/23aumh6u8s0i/5YDcN2Zobu6KIQKTwo7Mz6/ceb7fe5f1f58b9d5f97f041b336469b1/providers)

>You can see the full Custom Database Identity providers' documentation in the [official docs](https://auth0.com/docs/connections/database).

The integration is achieved by **customizable [Node.js](https://nodejs.org/en/) scripts** that can be coded directly on Auth0’s configuration dashboard manually or using a wide array of templates.

To _sum up_, we will be using the MongoDB protocol supported by Auth0 identity provider to connect to our Azure DocumentDB and store/retrieve our users' information by custom Node.js scripts.

## Creating our database

As we mentioned before, Azure DocumentDB supports the [creation of databases that support the MongoDB protocol](https://azure.microsoft.com/documentation/articles/documentdb-create-mongodb-account/) (as of the writing of this article, this feature is in preview). We must access the [Azure Portal](https://portal.azure.com/) and filter for DocumentDB services to find the version with MongoDB support:

![Searching the Azure Portal](https://images.ctfassets.net/23aumh6u8s0i/46tUO7aKgIngsjtt5o9Xl2/e2f9d8067bcc32913bd769aefefd6760/portal-search)
![Creating our Azure DocumentDB service](https://images.ctfassets.net/23aumh6u8s0i/4jnaA1af9wBqZcRYBd0SWw/40b5cd80f5a9057695378347e9c21352/portal-creation)

Once created, we will be able to access our **connection string** credentials on the instance blade. We need to take note of these values because we will use them later on the integration:

![Obtaining connection string](https://images.ctfassets.net/23aumh6u8s0i/5VhrjNoe4P21IxjEZbATHN/d210f820991d41aae13cae6600f1144b/portal-connectionstring)

After creating our service, we will proceed to create a **Database** and a **Collection** to store our data. If you are not familiar with the Database and Collection concepts for NoSQL databases, a Database can hold multiple Collections and each Collection will store Documents (in JSON format). You will be [billed](https://azure.microsoft.com/pricing/details/documentdb/) for _each Collection_, so plan your distribution accordingly.

>You can review the complete concept diagram in the [official documentation](https://azure.microsoft.com/documentation/articles/documentdb-resources/).

We will create an "auth0" database:

![Creating a database](https://images.ctfassets.net/23aumh6u8s0i/4Hpv8gIPflHC4ZVq3JV937/c6cb4db948cfef16a89c956c75bfd35b/portal-db)

And a "users" collection:

![Creating a collection](https://images.ctfassets.net/23aumh6u8s0i/1tsbGjkzMWA2bd5MfmdFGF/8bff858ba192585b62912b862390809f/portal-collection)

Azure DocumentDB lets you define a [dynamic and scalable throughput](https://azure.microsoft.com/documentation/articles/documentdb-performance-levels/) you can increase later as your application demands.

## Establishing the integration

In this step, we will use the connection string information we collected in the Azure Portal to create a **custom database provider**. In your Auth0 Dashboard, you will see a _Connections > Database_ configuration section:

![Auth0's Dashboard Connections menu](https://images.ctfassets.net/23aumh6u8s0i/3idCEu1z2jGhv12IZQOtLJ/1807cdf3162958eb5c7b9326831bdd12/dashboard-menu)

Once there, you can _Create a Db Connection_:

![Create Db Connection](https://images.ctfassets.net/23aumh6u8s0i/6tTuSPvTpnDkco5veH8nfc/6c87a231fa925cc5810349da4d6117d9/dashboard-button)

You will be asked for a _name_:

![Setting up Connection name](https://images.ctfassets.net/23aumh6u8s0i/2Udn4YepEwyH7ZQOpCdTYj/3a06b87a52342b5c13e8c8dc527ed1f9/dashboard-connection)

Once created, we will go to the Custom Database tab and enable the "**Use my own database**" toggle, which will activate the lower **Database Action Scripts** section.

The Auth0 editor allows us to define global variables to reuse on all our Node.js scripts. Let's start by setting a _global_ connection string; on the Settings subsection, we create a "ConnectionString" key and paste the Connection String value we obtained from the Azure Portal with the added _database_ name. 

Your copied string looks like this:

`mongodb://<your_service_name>:<your_password>==@<your_service_name>.documents.azure.com:10250/?ssl=true`

We will add the _database name_ after the port, like this:

`mongodb://<your_service_name>:<your_password>==@<your_service_name>.documents.azure.com:10250/auth0?ssl=true`

![Setting up global variable](https://images.ctfassets.net/23aumh6u8s0i/1U1XHtXLeqod4jdZzXIuAI/4518a6c11d470ac1bab4f15153b38483/dashboard-variable)

In our Node.js scripts, we can access this value by the global variable `configuration.ConnectionString`.

Now, we will define our custom _Login_, _Create_, _Verify_, _Change Password_ and _Delete_ scripts using our predefined variable:

__Login__

```javascript
function login (email, password, callback) {
  mongo(configuration.ConnectionString, function (db) {
    var users = db.collection('users');
    users.findOne({email: email}, function (err, user) {


if (err) return callback(err);

      if (!user) return callback();

      if (!bcrypt.compareSync(password, user.password)) {
        return callback();
      }
      callback(null,   {
        user_id:      user._id.toString(),
        nickname:     user.nickname,
        email:        user.email
      });

    });  
  });
}
```

__Create__

```javascript
function create (user, callback) {
  mongo(configuration.ConnectionString, function (db) {
    var users = db.collection('users');

    users.findOne({ email: user.email }, function (err, withSameMail) {

      if (err) return callback(err);
      if (withSameMail) return callback(new Error('the user already exists'));

      user.password = bcrypt.hashSync(user.password, 10);

      users.insert(user, function (err, inserted) {  
        if (err) return callback(err);
        callback(null);
      });
    });
  });
}
```

__Verify__

```javascript
function verify (email, callback) {
  mongo(configuration.ConnectionString, function (db) {
    var users = db.collection('users');
    var query = { email: email, email_verified: false };

    users.update(query, { $set: { email_verified: true } }, function (err, count) {
      if (err) return callback(err);
      callback(null, count > 0);
    });
  });
}
``` 

__Change Password__

```javascript
function changePassword (email, newPassword, callback) {
  mongo(configuration.ConnectionString, function (db) {
    var users = db.collection('users');

    var hashedPassword = bcrypt.hashSync(newPassword, 10);

    users.update({ email: email }, { $set: { password: hashedPassword } }, function (err, count) {
      if (err) return callback(err);
      callback(null, count > 0);
    });
  });
}
```

__Delete__

```javascript
function remove (id, callback) {
  mongo(configuration.ConnectionString, function (db) {
    var users = db.collection('users');
      var o_id = new mongo.ObjectID(id);
      users.remove({ _id: o_id }, function (err) {
      if (err) return callback(err);
      callback(null);
    });
  });
}
```   

And we can **test** the connection by running the _Create_ script from within the interface:

![Testing the connection](https://images.ctfassets.net/23aumh6u8s0i/DbMIqtC0nxWl2bUN7zb9l/7debe09b03d5fdc9752207aa90a3f99c/dashboard-test)

If we query the content of the Azure DocumentDB collection through the Azure Portal, we will find our created user:

```json
{
    "_id": {
      "$oid": "57f2983189b7550100e909e4"
    },
    "tenant": "ealsur",
    "connection": "DocumentDB",
    "email": "ealsur@ealsur.com.ar",
    "password": "$2a$10$hiSfzkpLjQUXivV4AvdakOCsTqDAYeSAx1Dn2HfPW6XuU28i5wgpq",
    "debug": true,
    "id": "57f2983189b7550100e909e4",
    "_rid": "u11qAL9JdQATAAAAAAAAAA==",
    "_self": "dbs/u11qAA==/colls/u11qAL9JdQA=/docs/u11qAL9JdQATAAAAAAAAAA==/",
    "_etag": "\"08007436-0000-0000-0000-57f298320000\"",
    "_attachments": "attachments/",
    "_ts": 1475516462
}
```

As you can see, this is a plain JSON object that is readable through any application-consuming collection.

Finally, we can create a new **Client Application** and define that we will use our custom Azure DocumentDB database on the **Connections** configuration.

>For a detailed concept explanation, you can read the [official Applications documentation](https://auth0.com/docs/applications).

![Defining the Application connection](https://images.ctfassets.net/23aumh6u8s0i/1T6umRxNDrBYvHLJzEMZN4/eb196da1bda24bf6d9ed569709c92a2e/dashboard-setup)

This will let our Client Application access and use the DocumentDB identity provider.

## User profile customization

Since Azure DocumentDB uses JSON to store our user profiles, we can take advantage of this dynamic data format and customize our **users' profile data** during sign-up.

To achieve this, we can use [Auth0's Lock](https://auth0.com/docs/libraries/lock) and configure the [required additional signup fields](https://auth0.com/docs/libraries/lock/v10/customization#additionalsignupfields-array-). This will generate the new fields and store them on our collection as part of the user profile without any extra work.

>You can also view the complete [Custom Signup documentation](https://auth0.com/docs/libraries/lock/v10/custom-signup) for a more detailed explanation.

## Conclusion

Auth0’s custom database **flexibility** lets us use one of the most dynamic and fast NoSQL service offerings available. Azure DocumentDB has the ability to **scale** and grow as your business or application does in a seemingly easy way.


Planet-scale authentication with Auth0 and Azure DocumentDB

eHk3ciM

I am the Group Manager, Developer Content at Okta, and a Google Developer Expert in Web Technologies and Angular. I'm passionate about identity, authentication, constant learning, and developer communities. As a developer advocate, engineer, mentor, and international speaker, I love learning from and sharing with other inhabitants of the tech space.

Group Manager, Developer Content

Kim Maida

Yahoo has confirmed that in late 2014, at least 500 million user accounts were stolen in a large-scale data breach, exposing names, emails, and more.



---

## Half a billion Yahoo accounts were leaked in large-scale data breach

Yahoo has confirmed that 500 million user accounts were exposed in a massive data breach that occurred in late 2014. Breached data potentially included users' names, emails, phone numbers, birthdates, hashed passwords, and in some cases, encrypted or unencrypted security questions and answers. Yahoo claims that financial information such as bank accounts or credit card credentials were not included in the breached data.

The official notification from Yahoo's Chief Information Security Officer Bob Lord can be read here: [An Important Message About Yahoo User Security](https://yahoo.tumblr.com/post/150781911849/an-important-message-about-yahoo-user-security).

Yahoo announced that the company believes the hacker to be a state-sponsored actor: a hacker acting on behalf of a non-US government. A spokesperson for the FBI said they are aware of the intrusion and investigation is underway.

[Verizon is currently in the process of acquiring Yahoo for $4.8 billion](http://www.usatoday.com/story/tech/news/2016/07/25/verizon-winner-yahoo-sale/87500668/). Verizon was made aware of the data breach within the last couple of days, but a spokesperson for the communications company claims Verizon has "limited information and understanding of the impact [of the security incident]."

To comprehend the scope of this attack, let's compare it to another within the last decade. In 2007, the [TJX data breach](http://www.nbcnews.com/id/21454847/ns/technology_and_science-security/t/tjx-breach-could-top-million-accounts/#.V-RR99yClTY) exposed 94 million credit and debit card accounts. At the time, it headlined as the biggest cybersecurity attack ever. At an estimated minimum of 500 million, the Yahoo incident leaked over five times as many accounts, making it the new largest data breach in history.

Yahoo asserts that they are notifying potentially affected users. The company is also recommending that users update their passwords and security questions if they have not done so since 2014. 

Although financial data may not have been leaked in the Yahoo data breach, Yahoo also provides login for [Flickr](https://www.flickr.com/) as well as [Oauth](https://developer.yahoo.com/oauth/) for third party websites. In addition, users frequently reuse the same email addresses and passwords for multiple accounts. When user credentials are leaked, it can compromise many more accounts than the one specifically exposed.  

## Aside: Protect your users from password leaks with Auth0

Auth0 provides breached password detection that can be enabled simply and easily. The Auth0 security team maintains a database of third party breached credentials. This database is updated daily. On each login, user credentials are checked against the leaked passwords database. If a breach is suspected, the user is notified and cannot log in until they change the compromised password.

<video autoplay loop width="600">
  <source src="https://cdn.auth0.com/blog/breach/lock-2.m4v"/>
<img src="https://images.ctfassets.net/23aumh6u8s0i/3DpdlDPwLfrdGGb7RUQ6NU/d959326b776a71764727d5e3eae43c8a/lock"/>
</video>

Read about [Breached Passwords](https://auth0.com/breached-passwords) and [Anomaly Detection](https://auth0.com/docs/anomaly-detection) to learn more about how to protect users and their credentials with Auth0. You can also <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>!



Yahoo Confirms Data Breach of Half a Billion User Accounts

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

A potential programming mistake raises unexpected privacy concerns among users



[Pokémon](https://en.wikipedia.org/wiki/Pok%C3%A9mon) has been a subject of passion for grown-ups and youngsters alike for a long time. The newly released Pokémon GO app is no exception: it has been installed by thousands since its release a few days ago. What they don't know is that they have given [Niantic](https://www.nianticlabs.com/), the developer, full access to their Google accounts!  

<include src="TweetQuote" quoteText="Pokémon GO has been installed by thousands and the developer has full access to their Google accounts!"/>

**Update:** Ari Rubinstein from Slack has [dived deeper](https://gist.github.com/arirubinstein/fd5453537436a8757266f908c3e41538) and performed an analysis of what can be done with tokens obtained using this authentication flow. It appears additional steps must be performed to obtain a full access token. These steps *are* possible for Pokemon GO, as it is granted access to the necessary APIs, though the app does not appear to be using them. This issue may be attributed to programming mistakes and a permissive API on the part of Google. Both Google and Niantic are looking into the issue and attempting to provide a fix as soon as possible.      

**Update 2:** Niantic has released an [official statement](https://support.pokemongo.nianticlabs.com/hc/en-us/articles/222648408-Permissions-update) regarding the Pokemon Go iOS permissions problem. And also, the app has been updated in the [App Store](https://itunes.apple.com/us/app/pokemon-go/id1094591345?mt=8) with the correct permission scopes. 

-----

## A Pokémon fan's dream game
Pokémon GO, available in [Apple's App Store](https://itunes.apple.com/us/app/pokemon-go/id1094591345?mt=8) and [Google's Play Store](https://play.google.com/store/apps/details?id=com.nianticlabs.pokemongo&hl=en), is an augmented-reality game that lets users be part of a world full of Pokémon ready to be caught. Using the phone's camera and GPS, Pokémon are distributed in the user's vicinity. Hints are displayed to give the user a notion of where to find Pokémon.
To give you an idea of what this means for your average Pokémon fan: it's wild. We've already heard stories of people going into bars just to catch Pokémon (no drinking involved (!)), others [finding corpses](http://arstechnica.com/gaming/2016/07/gamer-stumbles-onto-dead-body-while-testing-pokemon-gos-gps-fueled-features/). This is pretty much every Pokémon fan's dream game: a game that fuzzes the boundaries between fantasy and reality and lets users be part of an ever changing semi-real world full of Pokémon.

No wonder the explosion in social media. And among the many eyes looking at Pokémon GO [some](http://adamreeve.tumblr.com/post/147120922009/pokemon-go-is-a-huge-security-risk) were keen enough to notice users were giving full access to their Google accounts!

![All access in Google account](https://images.ctfassets.net/23aumh6u8s0i/18NnCNuefCyzRMLyS8EDYl/35b993c7d31ec4a45b128d6c31fa3a6a/allaccess)

## How this happened: Single-Sign-On 
We've written a lot about [single-sign-on](https://auth0.com/blog/2015/09/23/what-is-and-how-does-single-sign-on-work/) in the past. It's great, and it helps [businesses grow](http://www.appcues.com/blog/single-sign-on-the-one-click-growth-hack-youre-not-using/). Security is hard, though, and this is no exception. Most single sign on solutions sport a flow similar to the following:

1. An application, on behalf of a user, requests to login through a login provider.
2. The application redirects the user to the login provider's login screen.
3. The login provider authenticates the user and then proceeds to create an authentication/authorization token for the application to use.
4. The token is passed to the application, which can use the token on behalf of the user to perform certain operations with his/her account.

If the application has never operated on behalf of the user with that login provider, an additional step is inserted between step 3 and 4. This step is crucial and defines **what access the application will have to the user data in the login provider's system**. It is this step that is not working right in Pokémon GO.

![Have you ever seen this screen?](https://images.ctfassets.net/23aumh6u8s0i/6fDxO1JfL3WeHnivkKK4S4/6caebe064f53c55a31f147b83f36e44e/permissions)

For some reason this screen is not showing and the app is still getting full-access to Google accounts.

This means **emails (reading and sending), Google Drive documents, your browsing history, your photos, your maps and locations** are *all* available to Niantic. As far as we know, the Android version does not exhibit the same issue (unless you log in with an account previously used on an iOS device for Pokémon GO), so it was probably not the developer's intention to do this. In other words, this is probably a bug or a simple coding mistake.

Until this issue is resolved, our advice is to simply revoke the application's permissions to your Google account by going to the [connected apps page](https://security.google.com/settings/security/permissions).

**Update:** now we know why this screen is not being displayed. Read the excellent [analysis](https://gist.github.com/arirubinstein/fd5453537436a8757266f908c3e41538) by Ari Rubinstein and then take a look at [what is necessary](https://duo.com/blog/beyond-the-vulnerabilities-of-the-application-specific-password-exploiting-google-chrome-s-oauth2-tokens) to get a full access token from the one obtained by Pokémon GO. Although possible, there is no reason to believe Pokémon GO is exploting this.

## Let the experts do the hard work
Authentication and authorization are hard. Even when using the [excellent documentation provided by Google](https://developers.google.com/identity/sign-in/ios/sign-in) for their single-sign-on solution, bugs and mistakes happen. And when you are growing as fast as Pokémon GO, mistakes can be costly.

Our single-sign-on solution gives applications only minimal access to account details by default. Google, Facebook, Twitter and many other login providers are all supported and available under one click. Using a simple, safe-by-default solution can make all the difference between a costly mistake and smooth sailing. <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Try Auth0 now</a> and focus on your app, not logins.

These are our default permissions for Google sign-in: 

![Auth0 default Google permissions](https://images.ctfassets.net/23aumh6u8s0i/4PCBGqxkULDuVzTZViQCgr/3e2d55768158bfb7029e06b22006586a/auth0-perms-2)



Gotta Catch'em All: Pokémon GO Catches All Your Data!

Using Rules with Auth0 you can put your data to work and drive your marketing engine!

7 Ways to 2x Your Revenue Growth by Putting Your User Data to Work

eugenio-pace-new-avatar

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

CEO and Co-Founder

Eugenio Pace

Many companies rely on databases to store user credentials. Either because they use pre-built systems like ASP.NET Membership, or because they wanted to keep

Many companies rely on databases to store user credentials. Either because they use pre-built systems like ASP.NET Membership, or because they wanted to keep those users outside their main identity system (e.g. Active Directory) or just because of historical reasons ... (a.k.a. legacy)

In fact, one of the most requested features in ADFS was the ability to authenticate users _outside_ AD. A very annoying limitation in the product, that still has not been addressed.

Because this is so common, we decided to support it out of the box in Auth0. The __Auth0 Custom Connector__ is a component that you deploy to your infrastructure, that connects to any database (or anything really), and seamlessly integrates with Auth0.

Once setup is done (a very simple process in itself), you can continue to leverage those identities and connect them with any apps supported by Auth0: SharePoint, CRM, mobile, etc.

Here's the entire process in less than 3 minutes:



<iframe width="700" height="394" src="https://www.youtube.com/embed/p3rK7fgPEN0?rel=0" frameborder="0" allowfullscreen></iframe>

Notice that authentication with SQL (and MongoDb) is straight forward, but you can actually connect with whatever you want. This video shows an example that uses [edge](https://github.com/tjanczuk/edge) to call .NET code.

[Try Auth0 yourself!](https://auth0.com)

"user data"