Action in password-reset-post-challenge triggers twice

Get Help
,
1 
exports.onExecutePostChallenge = async (event, api) => {

    console.log("PR MFA Action Triggered")

    api.authentication.challengeWith( {type: "phone"} )

};

My goal is to ask users to complete an MFA challenge before they can reset their password. The rough-draft action above is what I have between the “Start” and “Complete” in the Password Reset / Post Challenge trigger. The problem is that after I click the password reset link in my email and get brought to the challenge screen, I get two back to back MFA codes instead of just one, and I can see that the action’s been triggered twice in the action logs, even when I remove the MFA challenge line and only keep console.log(), is this a bug with password reset trigger pipeline or could I have something misconfigured? Thanks!

3

Hi @hhh

Welcome to the Auth0 Community!

Looking at your Action code, there is no immediate indication that it would trigger two MFA prompt and I believe that it’s very likely some other factor might be causing this behaviour for you, such as another Action could also be configured to prompt for MFA.

I suggest unbinding other Actions ( if there are others ones ) and test this flow again on it’s own. If you are getting the correct behaviour, then your pw-reset|post-challenge Action works correctly, but another one interferes. In addition, I recommend also reading through our following documentation and checking out the Action template mentioned in the Password Reset Triggers - Auth0 Docs doc.

Let us know what you find!

Best regards,
Gerald

5

Thanks for the response! The issue was that our corporate email inbox uses a url security service that would click on the link first to prevent delivering spam/phishing emails, which would trigger the action first, and then a second time when the actual user would click it. Our solution is to use the challengeWithAny() method so that the user is always presented with an MFA option selection screen first. So although the action may still trigger twice, the MFA code only goes out after user makes their selection.

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.