How do you combine Auth0 Lock with Laravel Auth0?

[edmandiesamonte]

Is there a way to combine Auth0 Lock with Laravel Auth0?

Auth0 Lock supports responseType=code, and I'm planning to use Laravel Auth0 to handle the callback. Unfortunately, Laravel Auth0 has a stateful approach but there's no exposed function to issue a state token to the blade template.

Maybe changing the private properties and functions of Auth0Service is a good start so we could override and customize its behaviour?

I hope you could help. Thanks.

[joshcanhelp]

Hi @edsamonte,

This Laravel library is built on top of our PHP SDK and the callback handling is the same whether you use the hosted login page or Lock. You can stop the PHP SDK from handling state by passing in a dummy state handler on initialization. Then you can generate and store a value, pass that to Lock, and check within the callback.

That said, the options used to initialize the PHP SDK are loaded from the config file so you could pass that same dummy state handler in by default and handle state validation yourself. I have not tried this specifically so if you get stuck, let me know and I'm happy to help!

[edmandiesamonte]

Thanks for the suggestion, @joshcanhelp.

Though, it is not a good idea to create instantiated object on the config file. Config values should be as primitive as possible.

As a workaround, I just create a BootServiceProvider which is at the very first of all the service providers which sets the laravel-auth0.state_handler:

// BootServiceProvider
public function boot(){
    config([
        'laravel-auth0.state_handler' => new MyCustomStateHandler(new SessionStore())
    ]);
}

[joshcanhelp]

I should have mentioned, you can also just pass in false and the dummy one will be used.