Auth0 Multifactor Authentication Session Cookie Lifecycle and Customization
Last Updated:
Overview
Auth0 multifactor authentication (MFA) session cookies function with specific lifecycle behaviors. Administrators cannot modify the auth0-mf cookie directly, but can configure how long Auth0 trusts a browser by using the Idle Trusted Browser Lifetime and Maximum Trusted Browser Lifetime settings.
Applies To
- Auth0
- Multi-Factor Authentication (MFA)
- Session Cookie
Solution
How does the Auth0 MFA session cookie function?
The MFA session cookie (auth0-mf) establishes the trust level for a given device. By default, it has a seven-day inactivity timeout and a maximum sliding expiration lifetime of 30 days. Administrators can change both values, as described in the next section. Administrators cannot modify the cookie itself.
Auth0 sets the cookie immediately after the MFA challenge finishes, even when the Remember this device option is selected already. Auth0 renews the cookie with a sliding expiration when MFA is signaled as required, either via a Rule, an Action, or by the Always on policy. A renewed auth0-mf cookie returns on every /authorize request, allowing the MFA session to last up to the configured maximum lifetime (30 days by default). If the user removes or modifies this cookie in the browser, Auth0 prompts for MFA again.
By default, Auth0 enables a persistent session for the tenant. Auth0 does not clear the cookies, including the MFA cookie, when the user closes the browser. If the user closes the browser without logging out, the default behavior of Auth0 logs them back in automatically.
If administrators select a non-persistent session, Auth0 invalidates the session cookie when the browser is closed. If the user closes a tab but the browser process remains running, Auth0 typically does not clear non-persistent cookies for that tab until the browser process terminates. If the browser process remains running and the user opens a new tab at the application URL, all previously set cookies remain active.
Administrators can set the maximum duration of the Auth0 sign-in session via tenant settings, but this is an imperfect solution. If set to a low value, the sign-in session can expire while the user is using the application, causing further authorization requests to require re-authentication. If set too long, the user remains signed in.
How can administrators change the Remember this device lifetime?
The following settings control how long Auth0 trusts a browser:
| Setting | Default | Range |
|---|---|---|
| Idle Trusted Browser Lifetime | 7 days | 1 hour to 30 days |
| Maximum Trusted Browser Lifetime | 30 days | 1 hour to 90 days |
The idle lifetime cannot exceed the maximum lifetime. To change the values in the Auth0 Dashboard:
- Navigate to Auth0 Dashboard > Security > Multi-factor Auth.
- Scroll down to Additional Settings.
- Toggle on Allow User to Skip MFA on Trusted Browsers.
- Configure Idle Trusted Browser Lifetime and Maximum Trusted Browser Lifetime.
To change the values with the Management API, use the mfa_session_inactivity_timeout and mfa_session_overall_timeout properties (in seconds) of the Set the Guardian Settings endpoint.
Configure the MFA Prompt Behavior with Actions
When an Action triggers MFA, the process uses the api.multifactor.enable(provider, options) method. The options.allowRememberBrowser parameter is an optional boolean that determines if the browser should be remembered so that the MFA challenge can later be skipped. This parameter defaults to false.
When an Action triggers MFA and the configuration sets allowRememberBrowser to false, it overrides the Remember this device setting, and Auth0 prompts the user for MFA during every login.
The following post-login Action code enforces a custom MFA policy and disables the checkbox that allows the browser to remember the user's MFA for the configured trusted browser lifetime.
exports.onExecutePostLogin = async (event, api) => {
api.multifactor.enable("any", { allowRememberBrowser: false });
}
How do silent authentication and refresh tokens interact with MFA?
Silent authentication re-authenticates users without prompting them to log in. Silent authentication uses a session cookie to determine the user identity and does not display any user interaction, such as authentication, consent, or MFA.
A refresh token retrieves a new access token without user interaction.
