Allow factor-type restriction together with allowRememberBrowser: false in Actions MFA API

Product Feedback
, , ,
1

Feature: Support restricting MFA factor types together with allowRememberBrowser: false

Description:

The Actions MFA API splits two capabilities across two methods, with no way to combine them:

  • api.multifactor.enable(provider, { allowRememberBrowser: false }) suppresses the “Remember this device” checkbox, but provider only accepts 'any' | 'duo' | 'google-authenticator' | 'guardian'. There is no way to restrict to a specific subset of factor types.

  • api.authentication.challengeWithAny([{ type: 'webauthn-platform' }, ...]) restricts to a specific list of factor types, but does not accept allowRememberBrowser. Calling multifactor.enable(..., { allowRememberBrowser: false }) beforehand does not suppress the checkbox either.

Result: you can either restrict factors or hide the remember-device checkbox, never both.

Either of these would resolve it:

  1. Accept a factor-type array as the first argument of api.multifactor.enable, e.g. api.multifactor.enable(['webauthn-platform', 'webauthn-roaming'], { allowRememberBrowser: false }).

  2. Accept allowRememberBrowser as an option on challengeWith / challengeWithAny (already requested in this thread).

Use-case:

Step-up authentication flows where different operations require different classes of authenticator, with the required class indicated by acr_values. challengeWithAny is the only API that enforces the factor-type restriction, but it leaves the “Remember this device” checkbox visible, which contradicts a policy of re-authenticating every protected operation. Today, the only workarounds are a full ACUL implementation to hide one checkbox, or multifactor.enable('any') with downstream factor-class enforcement that denies users after they complete the wrong factor. Both are disproportionate for what one missing parameter is.

2

Hi @nadav.beladev

Welcome to the Auth0 Community!

Thank you for submitting this feature card, do not forget to upvote it to bring attention to this feature!

Kind Regards,
Nik

3

Commenting for future users:

Although using api.authentication.challengeWith* or api.authentication.enrollWith* does not permit setting allowRememberBrowser, the Auth0 docs claim:

```
When you allow the user to skip MFA, a cookie is
stored in the user’s browser. If the user has the cookie set but you
still want to require MFA, you have two options:

  • Set allowRememberBrowser to false
  • Set acr_values to http://schemas.openid.net/pape/policies/2007/06/multi-factor when calling the /authorize endpoint.

```

Currently, Auth0 does not in fact honor acr_values for the purpose of forcing MFA / bypassing a remembered browser. They have confirmed this is a bug, and encouraged sharing this with the Auth0 Community so they can gauge user interest in fixing the bug.

So… talk to your sales rep?