Authenticated Nuclei Scan for Auth0 React SPA

[Tomerkat]

Hey team , I’m trying to create a working Nuclei template for an authenticated scan of a React SPA that uses Auth0 for authentication, and I could use some help.

Here are the key details:

• Frontend: React SPA using the Auth0 React SDK
• Authentication flow: Authorization Code with PKCE (not ROPG)
• Token management: Done entirely client-side via SPA SDK
• Login flow: Redirect-based; no backend session/token injection
• Resource Owner Password Grant: Disabled

I’ve gone through the following docs:

• https://projectdiscovery.io/blog/scanning-login-protected-targets-with-nuclei
• https://docs.projectdiscovery.io/tools/nuclei/authenticated-scans
• https://docs.projectdiscovery.io/templates/protocols/javascript/protocol#javascript-protocol

However, I haven’t found a clear path for handling this kind of dynamic PKCE login flow with Nuclei. Since Nuclei doesn't appear to support intercepting or completing the redirect-based PKCE dance, is there a recommended way to:

Pre-fetch a token (manually or via Puppeteer) and inject it into the scan?
Use a browser automation step to perform the login and persist the session for the template?

Any working examples or approaches for scanning SPAs behind Auth0 (without ROPG) would be super helpful. Thanks in advance!