Auth0: Restrict E-Mails of users that can sign up

README.md

auth0-check-for-domain-hook

In hook.js, you'll find a piece of code to ensure that new users' emails match certain criteria.

You'll have to deploy it as a "Pre User Registration" hook at https://manage.auth0.com/#/hooks.

Additionally, enable the "Force Email Verification" rule in https://manage.auth0.com/#/rules - otherwise, new users can sign in without confirming their email addresses first.

hook.js

/**
@param {object} user - The user being created
@param {string} user.tenant - Auth0 tenant name
@param {string} user.username - user name
@param {string} user.password - user's password
@param {string} user.email - email
@param {boolean} user.emailVerified - is e-mail verified?
@param {string} user.phoneNumber - phone number
@param {boolean} user.phoneNumberVerified - is phone number verified?
@param {object} context - Auth0 connection and other context info
@param {string} context.requestLanguage - language of the client agent
@param {object} context.connection - information about the Auth0 connection
@param {object} context.connection.id - connection id
@param {object} context.connection.name - connection name
@param {object} context.connection.tenant - connection tenant
@param {object} context.webtask - webtask context
@param {function} cb - function (error, response)
*/
module.exports = function (user, context, cb) {
  var response = {};

  // Add user or app metadata to the newly created user
  // response.user = {
  //   user_metadata: { foo: 'bar' },
  //   app_metadata: { vip: true, score: 7 }
  // };
  var domains=[ '@gmail.com', '@outlook.com', '@anywhere.de' ];
  
  var okDomain = false;
  
  for (i=0;i<domains.length;i++) {
    if (user.email.indexOf(domains[i]) > -1) {
      okDomain=domains[i];
      i=domains.length;
    }
  }
  
  if ((user.emailVerified) || (!user.emailVerified && okDomain)) {
   response.user = user;
   return cb(null, response);  
  } else {
    const error = new Error("E-Mail-Address did not match requirements.");
    error.statusCode = 400;
    return cb(error);
  }
  
};