Redirect loop between app and Auth0: cookies, rules/actions, default login route

TL;DR: Symptom: browser bounces between the app and Auth0 until it errors. Cause: the app never establishes its session, or an Action/Rule bounces the user back. Session cookie not sticking: the app sets its session cookie on /callback but the browser rejects it (Secure flag on http, SameSite, or the AUTH0_SECRET rotating per deploy so the cookie never decrypts). Confirm - DevTools network tab: count the hops.

Diagnose: redirect loop

Symptom

Infinite or long redirect chain: app -> Auth0 -> app -> Auth0, ending in ERRTOOMANY_REDIRECTS.

Likely causes

1. Session cookie not sticking: the app sets its session cookie on /callback but the browser rejects it (Secure flag on http, SameSite, or the AUTH0_SECRET rotating per deploy so the cookie never decrypts).
2. Auth guard misconfigured: the app's "requires auth" check runs on the callback route itself, so the freshly authenticated user is bounced back to login.
3. An Action/Rule redirects (api.redirect.sendUserTo) without a resume path, or denies then the app retries login.
4. Default login route misconfigured: Auth0's "configure default login routes" sends unauthenticated users to the app login, which sends them back.

Confirm

• DevTools network tab: count the hops. If /callback returns 302 back to /authorize every time, the app session is not sticking: check the Set-Cookie response and whether the browser stores it.
• If the loop includes an Action redirect URL, the Action is the bouncer: check Actions > Flows and the tenant logs for the redirect event.
• Tenant logs: a successful login (s) followed immediately by another authorize with no token use means the app discarded the session.

Fix

• Cookie: https in production, stable AUTH0_SECRET/SECRET, correct cookie domain.
• Exclude the callback route from the auth guard.
• Action redirects must call api.redirect with a resume and handle the resume callback; or remove the redirect.

Verify

One clean login in incognito: authorize -> callback -> app page, three hops, session cookie present, no further redirects on refresh.

When to use this

• This covers exactly what the title says: Redirect loop between app and Auth0.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with Redirect; these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Compatibility

• Not pinned to a specific version; follows current Redirect behavior.

Auth0's default login routes doc explains the unauthenticated-user routing. The Actions redirect API (sendUserTo/resume) is documented in the Actions triggers docs. Verified against live docs 2026-09-26.