Based on the documentation, after successful authentication on Auth0, request gets redirected to Liferay callback URI with an auth token. My question is, how does Liferay determine that ‘auth token‘ is for a successfully authenticated user? can someone generate an ‘auth token’ on the fly to spoof a user?
The reason I’m asking that question is because I wanted to find out, if my Liferay App need additional call to Auth0 with this ‘auth token’ to ensure it is valid?
My assumption is that an additional payload (e.g. parameters, json, xml etc) will be part of the redirection, and very likely cryptographically signed.