Action in password-reset-post-challenge triggers twice

Get Help
,
1 
exports.onExecutePostChallenge = async (event, api) => {

    console.log("PR MFA Action Triggered")

    api.authentication.challengeWith( {type: "phone"} )

};

My goal is to ask users to complete an MFA challenge before they can reset their password. The rough-draft action above is what I have between the “Start” and “Complete” in the Password Reset / Post Challenge trigger. The problem is that after I click the password reset link in my email and get brought to the challenge screen, I get two back to back MFA codes instead of just one, and I can see that the action’s been triggered twice in the action logs, even when I remove the MFA challenge line and only keep console.log(), is this a bug with password reset trigger pipeline or could I have something misconfigured? Thanks!

3

Hi @hhh

Welcome to the Auth0 Community!

Looking at your Action code, there is no immediate indication that it would trigger two MFA prompt and I believe that it’s very likely some other factor might be causing this behaviour for you, such as another Action could also be configured to prompt for MFA.

I suggest unbinding other Actions ( if there are others ones ) and test this flow again on it’s own. If you are getting the correct behaviour, then your pw-reset|post-challenge Action works correctly, but another one interferes. In addition, I recommend also reading through our following documentation and checking out the Action template mentioned in the Password Reset Triggers - Auth0 Docs doc.

Let us know what you find!

Best regards,
Gerald

4

Thanks for the response Gerald! I tried this on another bare bones tenant where there are no other actions present with this code to keep it simple:

exports.onExecutePostChallenge = async (event, api) => {

  console.log("Action triggered")

};

And this is what I see in the logs when I go through the “Forgot Password” flow:

[{"msg":"Log streaming connected...","time":1769092429611,"source":"system"},{"msg":"Action triggered","time":1769092450001,"source":"user"},{"msg":"Action triggered","time":1769092450324,"source":"user"},{"msg":"Action triggered","time":1769092456580,"source":"user"},{"msg":"Action triggered","time":1769092463818,"source":"user"}]

You can see that the behaviour here is worse than the other tenant and I haven’t added any code for MFA specifically. If i change the code in the other tenant to only have the log statement and no MFA I still see it being triggered twice when I go through the flow.