Hi, thanks for this great example.

One thing that happened to me is when i tried to login from chrome extension, i got 'invalid origin' with chrome-extension:// as the origin. i also tried to add 'chrome-extension://*' in the auth0 client setting, but it's still not working.

any suggestion to fix this?

Hey there, thanks for posting your repos. You posted 2 repos, one poc and one that isn't. The one that isn't says you need to white list the chrome extension id, however, each installation of the chrome extension generates a new id for my users doesn't it? So doesn't that mean if I whitelist MY id, my users ID won't be whitelisted for the callback url?

Also additionally , does the POC version of your repo, solve the issue I spoke about earlier, not sure if I'm being clear, I'm a newbie with AUTH0 so forgive me if it's dumb question.

branch: chrome_identity

I got this working (great work BTW), but obviously can't decode the resulting token with my global secret. Which brings up the security issue.

If my server were to ignore decoding with a secret, anyone - that was willing - could create a valid token and impersonate someone (if they actually knew, for example, their google id). That's no good.

Now I'm trying to get around that issue by using a custom Authorization header scheme and hashing the generated secret. But then here we are again. An attacker could easily reverse engineer this and gain access.

Am I missing something here?