Understanding the Auth0 Challenge Settings Fail Open Feature

This article explains the functionality of the Fail Open setting within Auth0's Bot Detection Challenge feature. It clarifies the system's behavior when the bot detection service is unavailable and how this impacts the end-user authentication experience.

• Bot Detection

• Challenge Settings

The Challenge Settings for Bot Detection determine how the system behaves if the underlying bot detection service is unreachable during an authentication attempt.

Default Behavior (Fail Close)

By default, the system is configured to Fail Close. If the bot detection service cannot be reached, the authentication transaction is blocked from proceeding. This prioritizes security by ensuring a risk assessment is completed.

Fail Open Behavior

When Fail Open is enabled, the system will allow the authentication to proceed without a bot detection challenge if the service is unreachable. This prioritizes availability and a seamless user experience.

The end user does not see an error message on the login or registration page. The authentication process continues as if the challenge was successfully passed.

Logging

A specific, explicit log event is not created in the tenant logs when a "Fail Open" event occurs. The absence of a Pre-Login Assessment (pla) log event, which normally records the risk assessment, followed by a successful login, may serve as an indirect indicator that the bot detection service was unavailable and the system failed open.