Storing custom data in Auth0's `user_metadata` or `app_metadata` is a common pattern, but its security implications are often overlooked. The risk isn't Auth0's storage, but how you use it.
Key considerations:
* **Token Bloat:** Metadata is included in ID tokens by default. This increases token size, impacting API latency and potentially hitting size limits.
* **Overexposure:** Without careful rule scripts, you can expose sensitive operational data (`app_metadata`) to the frontend if tokens are misconfigured.
* **Cost:** Storing large objects (like full user preferences) can increase read/write operations against Auth0's Management API, impacting your monthly active user (MAU) costs.
If you must store custom data, treat Auth0 as a directory, not a database.
* Store only essential identifiers or flags.
* Keep large, sensitive, or frequently changing data in your own backend, referenced by a user ID.
Example rule to prevent exposing all `app_metadata` to the ID token:
```javascript
function (user, context, callback) {
// Only add a specific, non-sensitive flag to the ID token
context.idToken['https://yournamespace.com/needed_flag'] = user.app_metadata.someFlag;
// Do NOT return the entire app_metadata object
callback(null, user, context);
}
```
cost per transaction is the only metric