Reduce the Amount of Time of Remember Browser Setting in MFA for Testing

Last Updated: Feb 20, 2026

Overview

The customer wanted to remember MFA once per session, for what we suggested to use the remember browser flag, when customizing MFA flow via rules.
However, for testing the feature he was asking if we could remember the browser for a shorter period of time (so they can test without having to wait 30 days).

Symptoms

They have to wait 30 days to the MFA remembered browser to be expired - so they cannot make fast tests for this feature/setting

Steps to Reproduce

This is a sample of code similar to what the customer does:

function requireMfaOncePerSession(user, context, callback) {
global.completedMfaPerSession = false;
let completedMfa = false;
if (context && context.authentication && context.authentication.methods && context.authentication.methods.length > 0) {
completedMfa = \!\!context.authentication.methods.find(
(method) => method.name === 'mfa'
);
}

if (completedMfa) {
global.completedMfaPerSession = true;
}

callback(null, user, context);
}

Applies To

Remember Browser Setting
MFA

Cause

The amount of time the browser is remembered cannot be changed.

Troubleshooting

It seems that the only way possible would be to use a management API setting to clean the remember browser setting for a user.

Solution

The customer can hit this endpoint Auth0 Management API v2 to invalidate/clean all remembered browsers instead of waiting for 30 days.
By doing this, they can clean that setting for a specific user and test.