# Auth0 trigger \> post login: User can skip webauth enrollment by clicking "No thanks" and the next subsequent action is called

**URL:** <https://community.auth0.com/t/auth0-trigger-post-login-user-can-skip-webauth-enrollment-by-clicking-no-thanks-and-the-next-subsequent-action-is-called/169362>\
**Category:** Get Help\
**Tags:** webauth-factor, mfa\
**Created:** [January 20, 2025, 7:22am UTC](https://community.auth0.com/t/auth0-trigger-post-login-user-can-skip-webauth-enrollment-by-clicking-no-thanks-and-the-next-subsequent-action-is-called/169362 "2025-01-20T07:22:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![chin](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/chin/32/70985_2.png) [@chin](https://community.auth0.com/u/chin)\
**Post date:** [January 20, 2025, 7:22am UTC](https://community.auth0.com/t/auth0-trigger-post-login-user-can-skip-webauth-enrollment-by-clicking-no-thanks-and-the-next-subsequent-action-is-called/169362/1 "2025-01-20T07:22:53Z")

</div>

Hi,

Context:  
I have the following code in Auth0 Trigger: Post login

```auto
     api.authentication.enrollWith({type: 'webauthn-platform'})
     return api.authentication.enrollWith({type: 'recovery-code'})

```

This code is intended to enroll a recovery code after successfully enrolling webauthn-platform

**Current Behavior**  
Auth0 trigger \> post login: User can skip webauth enrollment by clicking “No thanks” and the next subsequent action “api.authentication.enrollWith({type: ‘recovery-code’})” is called

 ![1](https://global.discourse-cdn.com/auth0/original/3X/3/e/3eb9b8dbe5843fac13e5663c8810e9cf90bcab61.jpeg)

**Expected Behavior**  
Auth0 trigger \> post login: User can skip webauth enrollment by clicking “No thanks” and the next subsequent action **should not be called**

My goal is to ensure that `api.authentication.enrollWith({type: 'recovery-code'})` is not called if the user hasn’t successfully registered for WebAuthn

---

<div class="post-metadata">

**Author:** ![sumansaurav](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sumansaurav/32/70627_2.png) [@sumansaurav](https://community.auth0.com/u/sumansaurav)\
**Post date:** [January 20, 2025, 7:45pm UTC](https://community.auth0.com/t/auth0-trigger-post-login-user-can-skip-webauth-enrollment-by-clicking-no-thanks-and-the-next-subsequent-action-is-called/169362/3 "2025-01-20T19:45:07Z")

</div>

You can fix this by handling the WebAuthn enrollment response properly.

Here’s how we can modify the code:

```auto
/**
 * Handler for post-login Actions trigger
 * @param {Event} event - The event object
 * @param {API} api - The Actions API interface
 */
exports.onExecutePostLogin = async (event, api) => {
  try {
    // Attempt WebAuthn enrollment
    const webAuthnResult = await api.authentication.enrollWith({
      type: 'webauthn-platform'
    });

    // Only proceed with recovery code if WebAuthn was successful
    if (webAuthnResult.status === 'completed') {
      return api.authentication.enrollWith({
        type: 'recovery-code'
      });
    }

    // If WebAuthn was skipped or failed, log it and end
    console.log('WebAuthn enrollment was not completed');
    return;

  } catch (error) {
    console.error('Error during enrollment process:', error);
    // Handle error appropriately
    return;
  }
};

```

This approach ensures that:

1. Recovery code enrollment only happens after successful **WebAuthn** enrollment
2. Users who click “No thanks” won’t be prompted for recovery code enrollment
3. Any errors in the process are properly handled

Note: You need to check the WebAuthmResult statue and compare inside if block.

Supported documentation:

> **[Actions Triggers: post-login - API Object](https://auth0.com/docs/customize/actions/explore-triggers/signup-and-login-triggers/login-trigger/post-login-api-object)**
>
> Learn about the post-login Action trigger's API object.

---

<div class="post-metadata">

**Author:** ![chin](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/chin/32/70985_2.png) [@chin](https://community.auth0.com/u/chin)\
**Post date:** [January 21, 2025, 4:00am UTC](https://community.auth0.com/t/auth0-trigger-post-login-user-can-skip-webauth-enrollment-by-clicking-no-thanks-and-the-next-subsequent-action-is-called/169362/4 "2025-01-21T04:00:28Z")

</div>

HI,

I checked, and `enrollWith` method does **not** return a value, so I can’t check the `WebAuthResult.status`

 ![Screenshot 2568-01-21 at 10.57.19](https://global.discourse-cdn.com/auth0/original/3X/3/6/368e6846b364f528639e1c96605e96b3052b6b79.png)

---

<div class="post-metadata">

**Author:** ![sumansaurav](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sumansaurav/32/70627_2.png) [@sumansaurav](https://community.auth0.com/u/sumansaurav)\
**Post date:** [January 21, 2025, 5:13am UTC](https://community.auth0.com/t/auth0-trigger-post-login-user-can-skip-webauth-enrollment-by-clicking-no-thanks-and-the-next-subsequent-action-is-called/169362/5 "2025-01-21T05:13:04Z")

</div>

Hi @chin ,

Apology for overlooking into this.

Here is what you can try:

```auto
async function main(event, api) {
  try {
    // First attempt WebAuthn enrollment
    await api.authentication.enrollWith({type: 'webauthn-platform'});
    
    // Check if webauthn-platform is now in enrolled factors
    const hasWebAuthn = event.user.enrolledFactors?.some(
      factor => factor.type === 'webauthn-platform'
    );
    
    // Only proceed with recovery code if WebAuthn was successfully enrolled
    if (hasWebAuthn) {
      return api.authentication.enrollWith({type: 'recovery-code'});
    }
    
  } catch (error) {
    console.log('Enrollment error:', error);
    return;
  }
}

```

However, there’s one potential limitation to consider: The `event.user.enrolledFactors` might not be immediately updated after the WebAuthn enrollment in the same action execution. If this is the case, we might need to handle this differently, perhaps by:

1. Using a Post MFA trigger instead of Post Login
2. Splitting this into two separate actions
3. Using app metadata to track the enrollment state

Let me know if this doesn’t work

---

<div class="post-metadata">

**Author:** ![chin](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/chin/32/70985_2.png) [@chin](https://community.auth0.com/u/chin)\
**Post date:** [January 21, 2025, 9:19am UTC](https://community.auth0.com/t/auth0-trigger-post-login-user-can-skip-webauth-enrollment-by-clicking-no-thanks-and-the-next-subsequent-action-is-called/169362/6 "2025-01-21T09:19:10Z")

</div>

Thank you for your responses.

Unfortunately, `event.user.enrolledFactors` is not updated immediately, and the other suggested solutions don’t work for me.

For now, I’ll have to skip “recovery-code” enrollment if the first enrollment is “webauthn-platform.”