Feature: Allow allowRememberBrowser in thechallengeWith and challengeWithAnyAPIs
Description: The newer challengeWith and challengeWithAny APIs allow for fully customizing the MFA experience except for disabling allowRememberBrowser. Currently this is available with the olderapi.multifactor.enable(‘any’, { allowRememberBrowser: false });method. This deficiency has prevented us from adopting the new API as our use-case requires us to disable the allowRememberBrowser feature.
Use-case: Custom MFA experience where the ability to “remember me” is controlled by the user’s organization. The parameters/conditions for “remembering” the user are also customized.
Thank you for creating this feedback card. Please make sure to upvote it so that it gets as many votes as possible and attracts as many community members as possible.
Although using api.authentication.challengeWith* or api.authentication.enrollWith* does not permit setting allowRememberBrowser, the Auth0 docs claim:
```
When you allow the user to skip MFA, a cookie is
stored in the user’s browser. If the user has the cookie set but you
still want to require MFA, you have two options:
Set allowRememberBrowser to false
Set acr_values to http://schemas.openid.net/pape/policies/2007/06/multi-factor when calling the /authorize endpoint.
```
Currently, Auth0 does not in fact honor acr_values for the purpose of forcing MFA / bypassing a remembered browser. They have confirmed this is a bug, and encouraged sharing this with the Auth0 Community so they can gauge user interest in fixing the bug.