MFA Challenge Prompts User Despite Selecting "Remember this device for 30 days"

A user is repeatedly challenged for multi-factor authentication (MFA) on a weekly basis, even after selecting the Remember this device for 30 days option during a previous login.

• Multi-factor Authentication (MFA)

• Remember this device

This behavior is related to the configuration of the MFA session cookie. The cookie has two key properties: a seven-day inactivity timeout and a 30-day maximum sliding expiration lifetime.

When a user checks the Remember this device for 30 days option, the cookie's lifetime is not automatically extended to 30 days. Instead, this action enables a sliding expiration. The cookie is set with a seven-day lifetime after the initial MFA challenge. This cookie is only renewed when the user is prompted for MFA again within that seven-day window. If the user does not trigger an MFA prompt within seven days, the cookie expires, and they will be challenged for MFA at their next login.

Additionally, this feature may not work as expected if:

• An Action is configured to conditionally skip MFA, which prevents the cookie from being renewed.
• The application is using non-persistent sessions, which do not allow the device to be remembered.

This is the expected behavior based on the design of the MFA session cookie. The Remember this device for 30 days feature relies on a sliding expiration that requires the user to trigger an MFA prompt at least once every seven days to keep the session active for the full 30-day period.

The MFA session cookie has a seven-day inactivity timeout, implemented with a cookie lifetime of seven days, and a maximum sliding expiration lifetime of 30 days.

When selecting the Remember this device option, the cookie's lifetime is not extended to 30 days automatically. Instead, it activates a process that will renew the MFA cookie every time the user should be prompted for MFA, until it reaches the 30 days limit. 

The cookie is set right after the MFA challenge is finished when Remember this device is checked. The cookie is renewed (sliding expiration) when the MFA is signaled as required, either by an Action or by the Always on policy. Then, a renewed auth0-mf cookie will be returned on every authorize request so that the MFA session can last up to 30 days.

It is important to note that the MFA cookie will only be renewed when the user is (or should be) prompted for MFA. Adding an Action that conditionally skips MFA may result in the user not falling into the MFA required policy, hence the cookie will not be renewed, breaking the Remember this device for 30 days flow.

Another reason this may happen is due to using non-persistent sessions, where there is no way to remember the device for 30 days.