Auth0 Multi-Factor Authentication Prompts Occur When Using the allowRememberBrowser Flag With Email

When using the allowRememberBrowser flag in Auth0 Actions, Auth0 prompts users for Multi-Factor Authentication (MFA) at the next login if email is the only enrolled factor. Auth0 only supports the flag when administrators configure more than one factor to prevent security vulnerabilities. To resolve this, enroll users in at least one additional MFA factor.

When a user selects the option to remember the device for 30 days via the allowRememberBrowser flag using Actions, Auth0 prompts for MFA at the next login if email is the only required or enrolled factor, as demonstrated in the following example:

exports.onExecutePostLogin = async (event, api) => {
    api.authentication.challengeWithAny([{type: "email"}]);
}

• Auth0
• Actions
• 'allowRememberBrowser' Flag
• Multi-Factor Authentication (MFA)

Auth0 only supports the allowRememberBrowser flag if administrators configure more than an email factor. This restriction exists because relying solely on email for both password resets and MFA creates a single point of failure. If a malicious actor gains access to an email inbox, the actor can reset the password and complete the email MFA challenge, bypassing true multi-factor security. Auth0 disallows the remember browser flow in this scenario to prevent the implied security of MFA when the authentication process only uses a single factor.

How is the allowRememberBrowser flag configured to work with email Multi-Factor Authentication?

To ensure the remember browser option functions correctly with email MFA, enroll the user in at least one additional factor.

Implement the workaround and secure the authentication flow by following these guidelines:

1. Enroll the user in at least one other MFA factor, even if the login flow does not explicitly call that factor.
2. Customize the password reset process to rely on a factor other than email if the configuration requires email as the default second factor for login.