auth0
407 sites
Security covered
Project Status
The Auth0 Drupal module is no longer deprecated and is currently minimally maintained. Originally managed by the Auth0 community, the project has resumed active development with the release of version 5.x.
The latest release uses version 8.x of the auth0/auth0-PHP library, which provides support for PHP 8.1+.
What's New in 5.x
The 5.x release represents a major architectural overhaul focused on security, simplicity, and modern Drupal integration.
Key Changes
- Universal Login Only — The embedded Auth0 Lock widget has been removed. All authentication now routes through Auth0's Universal Login page, improving security and feature compatibility.
- External Auth Integration — The module now uses Drupal's External Auth module for user authentication, providing tighter integration with Drupal's native user system.
- Streamlined Configuration — Configuration options have been simplified to focus on essential settings. Obsolete options (Widget CDN, Lock settings, form customization) have been removed.
- Enhanced Security — A new Cookie Secret requirement has been added, along with improved Key module integration for secure credential storage.
- Modern Support — Drupal 11 and PHP 8.3 Support
Removed Features
- Embedded Lock widget/form
- Widget CDN configuration
- Lock extra settings and CSS customization
- Form title and signup settings (now handled via Auth0's Universal Login)
Migration Notes
If upgrading from 4.x:
- Users will be redirected to Auth0's Universal Login instead of seeing an embedded login form
- Lock-specific configurations will be ignored
- A Cookie Secret must be configured
- Consider using the Key module for credential security
Alternative Solution
Drupal now supports OIDC natively via the Drupal OpenID Connect / OAuth client module. This may be a viable alternative depending on your requirements, though it will change the user experience if you are currently using the Auth0 module.