如何在现有Auth0托管登录流程中获取JWT令牌

Hey there, let's tackle this without tossing out your existing working flow first—no need to jump straight to API login just yet. Here's how to get that JWT in your hands with minimal changes:

1. Tweak Auth0 Cookie Settings for Cross-Subdomain Access #

Since you're using a CNAME (CNAME.example.com) for your Auth0 hosted pages, you need to make sure Auth0's cookies are accessible to your main domain (example.com):

• Head to your Auth0 app dashboard → Settings → Advanced → Cookies
• Set Cookie Domain to .example.com (the leading dot lets subdomains and the root domain share cookies)
• Keep Http Only and Secure checked for security—this aligns with your requirements

Once this is set, Auth0 will store tokens in cookies that your main example.com domain can read after the redirect.

2. Grab JWT via Auth0 WordPress Plugin Hooks #

The Auth0 WordPress plugin is already handling the token exchange under the hood—it just doesn't expose the JWT by default. Use these plugin hooks to pull the tokens when a user logs in:

Add this code to your theme's functions.php file (or a custom plugin):

add_action( 'auth0_user_login', 'fetch_auth0_jwt', 10, 3 );
function fetch_auth0_jwt( $wp_user_id, $wp_user_meta, $auth0_user_data ) {
    // Pull tokens from the Auth0 user data object
    $id_token = $auth0_user_data['idToken'];
    $access_token = $auth0_user_data['accessToken'];

    // Store the ID token in a secure cookie accessible to your main domain
    setcookie(
        'auth0_id_token',
        $id_token,
        time() + 3600, // Expire in 1 hour (adjust as needed)
        '/',
        '.example.com',
        true, // Secure (only over HTTPS)
        true  // HttpOnly (prevents XSS access)
    );
}

This hook fires right after a user logs in successfully. The cookie will be available to all pages on example.com so you can access it server-side (client-side access is blocked by HttpOnly, which is intentional for security).

3. Verify Auth0 App Token Configuration #

If the hook isn't pulling tokens, double-check these settings in your Auth0 app:

• Allowed Web Origins: Make sure https://example.com is listed here (under Settings)
• Response Type: Set this to id_token token (or code id_token token if using authorization code flow) to ensure both ID and access tokens are returned
• API Audience & Scopes: If you're using a custom API, confirm your app is authorized to access it and that you're requesting scopes like openid email profile (required for ID tokens)

Should You Switch to API Login? #

Only consider this if the above steps don't work. Using Auth0's Authentication API (/oauth/token endpoint) means building your own login form, handling password submissions, and managing token storage—doable, but it adds more code and reduces the security benefits of using Auth0's hosted pages (which prevent your app from handling raw passwords).

Your current hosted page flow is Auth0's recommended approach for security, so prioritize the configuration tweaks and plugin hooks first.

内容的提问来源于stack exchange，提问作者DanielM