Redirect to Login
chuck-john opened this issue · comments
Hello. We're attempting to redirect users to the auth0 login page without a button press. Is this what the redirect route is meant to accomplish? If so, the action seems to be left out of the sample controller.
A similar question was asked in #43, but it's still not clear how to capture the login URL manually.
If you want to go through omniauth it seems you'd have to enable GET requests to the /auth/:provider route using the following code in an initializer:
OmniAuth.config.allowed_request_methods << :get
After that you can simply redirect_to '/auth/auth0'. Hoever, this is deemed undesirable because of CVE-2015-9284. It is recommended to only let the user access the sign in page explicitly (using a POST button/link).