Auth0 Multifactor Authentication Session Cookie Lifecycle and Customization
Last Updated:
Overview
Auth0 multifactor authentication (MFA) session cookies function with specific lifecycle behaviors. Administrators cannot configure the auth0-mf cookie or set a custom value for the 30-day device memory option in the console.
Applies To
- Auth0
- Multi-Factor Authentication (MFA)
- Session Cookie
Solution
How does the Auth0 MFA session cookie function?
Administrators cannot configure the auth0-mf cookie or set a custom value for the Remember this device for 30 days option, which includes a seven-day inactivity setting. The MFA session cookie (auth0-mf) establishes the trust level for a given device. It has a seven-day inactivity timeout, implemented with a cookie lifetime of seven days, and a maximum sliding expiration lifetime of 30 days.
Auth0 sets the cookie immediately after the MFA challenge finishes, even when the Remember this device option is selected already. Auth0 renews the cookie with a sliding expiration when MFA is signaled as required, either via a Rule, an Action, or by the Always on policy. A renewed auth0-mf cookie returns on every /authorize request, allowing the MFA session to last up to 30 days. If the user removes or modifies this cookie in the browser, Auth0 prompts for MFA again.
By default, Auth0 enables a persistent session for the tenant. Auth0 does not clear the cookies, including the MFA cookie, when the user closes the browser. If the user closes the browser without logging out, the default behavior of Auth0 logs them back in automatically.
If administrators select a non-persistent session, Auth0 invalidates the session cookie when the browser is closed. If the user closes a tab but the browser process remains running, Auth0 typically does not clear non-persistent cookies for that tab until the browser process terminates. If the browser process remains running and the user opens a new tab at the application URL, all previously set cookies remain active.
Administrators can set the maximum duration of the Auth0 sign-in session via tenant settings, but this is an imperfect solution. If set to a low value, the sign-in session can expire while the user is using the application, causing further authorization requests to require re-authentication. If set too long, the user remains signed in.
Actions Configure the MFA Prompt Behavior
When an Action triggers MFA, the process uses the api.multifactor.enable(provider, options) method. The options.allowRememberBrowser parameter is an optional boolean that determines if the browser should be remembered so that the MFA challenge can later be skipped. This parameter defaults to false.
When an Action triggers MFA and the configuration sets allowRememberBrowser to false, it overrides the Remember this device setting, and Auth0 prompts the user for MFA during every login.
The following post-login Action code enforces a custom MFA policy and disables the checkbox that allows the browser to remember the user's MFA for up to 30 days.
exports.onExecutePostLogin = async (event, api) => {
api.multifactor.enable("any", { allowRememberBrowser: false });
}
How do silent authentication and refresh tokens interact with MFA?
Silent authentication re-authenticates users without prompting them to log in. Silent authentication uses a session cookie to determine the user identity and does not display any user interaction, such as authentication, consent, or MFA.
A refresh token retrieves a new access token without user interaction.
