Auth0 MFA via Actions Forces MFA Despite "Remember This Device for 30 Days" Being Selected

In Auth0 Actions, the api.authentication.challengeWith() method enforces a Multi-Factor Authentication (MFA) challenge and ignores the Remember this device for 30 days option if the api.authentication.enrollWith() method executes subsequently. To resolve this issue, place the enrollWith method inside a conditional statement to prevent execution when no factors require registration. End-users experience repeated MFA prompts during login attempts, even after selecting the option to remember the device.

The following example code asks an end-user to register a One-Time Password (OTP) MFA during the first login and pass an MFA challenge using OTP in subsequent login attempts.

exports.onExecutePostLogin = async (event, api) => {
  api.authentication.challengeWith({ type: "otp" })
  // Auth0 skips enrollment if the end-user already registered a One-Time Password (OTP) MFA
  api.authentication.enrollWith({ type: "otp" })
}

• Auth0
• Multi-Factor Authentication (MFA)
• Actions
• Code

The challengeWith method enforces MFA if the enrollWith method executes in the subsequent code to protect the account from bad actors. This behavior ignores the remember device option.

The enrollWith method fails when the user already registered all possible factors. If the user is already enrolled in all supplied factors, including both the default value and any additional factors, the command fails. Review the Actions Triggers: post-login - API Object documentation for more details.

How does an administrator configure the Auth0 Action to respect the remember device option?

Implement the following code to place the enrollment method in a conditional statement and avoid executing it if there are no factors available for registration.

if(event.user.enrolledFactors?.map(f => f.type).includes('otp')) {
  api.authentication.challengeWith({ type: "otp" });
} else {
  api.authentication.enrollWith({ type: "otp" });
} 

How does an administrator force Multi-Factor Authentication intentionally?

Certain scenarios require forcing MFA despite users selecting the option to remember the device. Use the following clause to force MFA and ignore the Remember this device for 30 days option when end-users access sensitive areas of an application.

api.multifactor.enable(provider, { allowRememberBrowser: false });