# How to prevent auto authentication on join\_url after using start\_url? **URL:** \ **Category:** API and Webhooks\ **Created:** [May 4, 2020, 10:22pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092 "2020-05-04T22:22:42Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![edwinthinks](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/edwinthinks/32/1895_2.png) [@edwinthinks](https://devforum.zoom.us/u/edwinthinks)\ **Post date:** [May 4, 2020, 10:22pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/1 "2020-05-04T22:22:42Z")
**Description** Hello, I’ve been using the Zoom API to generate Zoom Meetings and I noticed that the Zoom seems to auto authenticate users that have used the `start_url` before. That means, the once a user has used the `start_url` once… they have to enter in as a host (unless they clear cookies out). This is mostly problematic because the `start_url` won’t work for any users that need to use the web client. Meaning a user that uses the `start_url` is then forced to download and use the application. Is there any way to prevent the `join_url` from being authenticated due to (possibly) cookies from the `start_url` joining? **How To Reproduce (If applicable)** 1. Create a zoom meeting via API 2. Utilize the `start_url` and exit 3. Utilize the `join_url` and try to enter in with the web client. You are forced to login and then it link won’t work. ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [May 7, 2020, 8:35pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/2 "2020-05-07T20:35:31Z")
Hey @edwinthinks, That is strange. The start\_url should not collide with the join\_url logic. > [@edwinthinks](#): > > Utilize the `start_url` and exit What do you mean by exit? > [@edwinthinks](#): > > Utilize the `join_url` and try to enter in with the web client. You are forced to login and then it link won’t work. Is this the same user that is using both the start and join url? Thanks, Tommy ---
**Author:** ![samly](https://avatars.discourse-cdn.com/v4/letter/s/a87d85/32.png) [@samly](https://devforum.zoom.us/u/samly)\ **Post date:** [May 8, 2020, 4:39pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/3 "2020-05-08T16:39:38Z")
You could strip the ZAK token from the start\_url or just build it yourself: [https://zoom.us/s/meetingID](https://zoom.us/s/meetingID) That way, if the user is not already signed in as a host/alt\_host, they will be prompted for authentication and not just the user defined as part of the ZAK token. ---
**Author:** ![edwinthinks](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/edwinthinks/32/1895_2.png) [@edwinthinks](https://devforum.zoom.us/u/edwinthinks)\ **Post date:** [May 8, 2020, 6:56pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/4 "2020-05-08T18:56:53Z")
Hey Tommy, > What do you mean by exit? I click on a link that goes to the `start_url` and close the browser window before entering the meeting. > Is this the same user that is using both the start and join url? Hmm, it is the same person. But we aren’t having our users authenticate prior to clicking the `start_url` ---
**Author:** ![edwinthinks](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/edwinthinks/32/1895_2.png) [@edwinthinks](https://devforum.zoom.us/u/edwinthinks)\ **Post date:** [May 8, 2020, 6:58pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/5 "2020-05-08T18:58:34Z")
Hey samly, Thanks for the suggestion. However, I believe that the `join_url` acts as a `start_url` without the ZAK token. The problem is the `join_url` seems to change into the `start_ur` if i’ve ever navigated to the `start_url` before. I hope this makes sense. Let me know if I can provide more clarifications. ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [May 13, 2020, 11:19pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/6 "2020-05-13T23:19:30Z")
Hey @edwinthinks, Thanks for the additional details. Can you share what device / Zoom App version you are using so I can have the engineers look into this further? -Tommy ---
**Author:** ![edwinthinks](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/edwinthinks/32/1895_2.png) [@edwinthinks](https://devforum.zoom.us/u/edwinthinks)\ **Post date:** [May 15, 2020, 10:18pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/7 "2020-05-15T22:18:23Z")
Hey there Tommy, I am using a Mac 10.14.6 and I was using Zoom Client 4.0? Although this problem seems to happen without using the app it seems. Thanks! ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [May 20, 2020, 9:19pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/8 "2020-05-20T21:19:04Z")
Hey @edwinthinks, Just so I understand correctly, you are not wanting to use the Zoom App, you want to use the start\_url for the Zoom Web Client? Can you provide your use case here? Thanks, Tommy ---
**Author:** ![osdev](https://avatars.discourse-cdn.com/v4/letter/o/aca169/32.png) [@osdev](https://devforum.zoom.us/u/osdev)\ **Post date:** [June 17, 2020, 8:50pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/9 "2020-06-17T20:50:16Z")
Hello, We’re having the same issue. Actually, the issue comes from the Cookies left in the browser. When using first the “start\_url” with the zak token, seems like it’s writing something in the cookies. Then, when closing Zoom (without being logged), and then use the simple “join\_url” without any zak token, it goes-in automatically as the previous host! It’s a huge security concern, because the previous start\_url was not used with a login, but seems like it’s leaving traces of the host user in the browser. Perhaps the solution would be not to write any cookies to the browser when using “start\_url”. Which other solution would you offer? Thanks ---
**Author:** ![osdev](https://avatars.discourse-cdn.com/v4/letter/o/aca169/32.png) [@osdev](https://devforum.zoom.us/u/osdev)\ **Post date:** [June 17, 2020, 9:14pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/10 "2020-06-17T21:14:27Z")
An additional point, which may be the essentiel point for me: When using a custom join\_url link for a invited user ([zoom.us/w/MeetingID?tk=Token](http://zoom.us/w/MeetingID?tk=Token)), it should override any saved cookie data from before. And now it’s not doing it… I have no way to force the person to login as the “invited user” URL, if the the previous URL was a start\_url, it would go inside as a host, even the Meeting is closed, and Zoom App is closed. I’ve found out that if I go first to [zoom.us/logout](http://zoom.us/logout), before browsing to the join\_url for the invited user, then the user comes as his real name, and not as a host. I think this is a main security concern. There shouldn’t be any reason that when simply using a start\_url link, it should leave traces on the zoom website… Please advise, Thanks ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [June 19, 2020, 8:48pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/11 "2020-06-19T20:48:11Z")
Hey @osdev, Thanks for sharing these details, I will pass them to our engineering asap so we can investigate and fix the issue. (ZOOM-171226) Thanks, Tommy ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [June 24, 2020, 6:44pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/12 "2020-06-24T18:44:00Z")
Hey @osdev, I have just private messaged you to request the start\_url and join\_url so we can reproduce the issue. Thanks, Tommy ---
**Author:** ![online-days](https://avatars.discourse-cdn.com/v4/letter/o/e9bcb4/32.png) [@online-days](https://devforum.zoom.us/u/online-days)\ **Post date:** [June 26, 2020, 4:22am UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/13 "2020-06-26T04:22:15Z")
Hi @tommy, same thing here. If I use a start\_url, leave the meeting and then go to the join\_url, I am still the host. This is true even if it is another meeting in our account. Can you please provide me with information wether we can expect a change here soon? Kind regards, Ben ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [June 26, 2020, 8:58pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/14 "2020-06-26T20:58:04Z")
Hey @online-days, We are looking into this issue. We should have an update on its status by next week. Thanks, Tommy ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [June 29, 2020, 3:59pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/15 "2020-06-29T15:59:06Z")
Hey @online-days, @osdev, @edwinthinks, @samly, Our engineering team is testing this and looking into the best way to implement the fix. I will keep you all updated on it’s development. Thanks, Tommy ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [June 30, 2020, 4:52pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/16 "2020-06-30T16:52:28Z")
Hey @online-days, Can you please provide a video of this? Our engineers need more details. Thanks, Tommy ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [August 12, 2020, 4:51pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/17 "2020-08-12T16:51:50Z")
Hey @samly, @osdev, @online-days, @edwinthinks, This will be fixed later this month. 🙂 Thanks, Tommy ---
**Author:** ![dpb36dpb36](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/dpb36dpb36/32/30765_2.png) [@dpb36dpb36](https://devforum.zoom.us/u/dpb36dpb36)\ **Post date:** [January 31, 2021, 7:03am UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/18 "2021-01-31T07:03:15Z")
is ZOOM-171226 already fixed? i still act as host when using join url ---
**Author:** ![ow799877](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ow799877/32/22363_2.png) [@ow799877](https://devforum.zoom.us/u/ow799877)\ **Post date:** [January 31, 2021, 12:17pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/19 "2021-01-31T12:17:20Z")
THANK FOR SHARING YOUR WORDS ABOUT [best boom mic for dslr](https://bestshotgunmic.com/best-shotgun-mic-for-dslr/). ---
**Author:** ![will.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/will.zoom/32/14417_2.png) [@will.zoom](https://devforum.zoom.us/u/will.zoom)\ **Post date:** [February 1, 2021, 6:37pm UTC](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092/20 "2021-02-01T18:37:10Z")
Hi @dpb36dpb36, This should be fixed. Can you confirm that you’re not already logged into [zoom.us](http://zoom.us) or the Zoom Client as the meeting host when you click on the join\_url? Does this still happen if you join via incgonito mode? Let me know—thanks! Will [Next page](https://devforum.zoom.us/t/how-to-prevent-auto-authentication-on-join-url-after-using-start-url/16092.md?page=2)