Auth0 Security Breach Response — Responding to Security Incidents in Auth0

// Incident response: force password reset for affected users
async function forcePasswordReset(userIds) {
  for (const userId of userIds) {
    await auth0.users.update(
      { id: userId },
      {
        password: crypto.randomBytes(32).toString('hex'),
        app_metadata: { force_password_reset: true, breach_flagged_at: new Date().toISOString() }
      }
    );
  }
}

// Revoke all user tokens
async function revokeUserSessions(userId) {
  await auth0.users.invalidateSessions({ id: userId });
}

// Rotate compromised client secret
async function rotateClientSecret(clientId) {
  const client = await auth0.clients.rotateClientSecret({ client_id: clientId });
  await secretManager.storeSecret(clientId, client.data.client_secret);
  return client.data.client_secret;
}

// Block compromised client
async function blockClient(clientId) {
  await auth0.clients.update({ client_id: clientId }, { is_first_party: false });
}

// Audit: query for suspicious activity
const suspiciousLogs = await auth0.logs.getAll({
  q: 'type:f AND date:[now-1h TO now] AND ip_blocklisted:false',
  per_page: 100
});