Behavior of the allowRememberBrowser Option When Using api.multifactor.enable in Actions

Knowledge Articles
1

Overview

This article explains why a user’s browser may not be remembered, requiring the user to perform Multifactor Authentication (MFA) multiple times per session when using api.multifactor.enable(‘any’) in an Action.

Applies To

  • Actions
  • Multifactor Authentication (MFA)

Cause

The allowRememberBrowser parameter, responsible for allowing users’ devices to be trusted for 30 days before requiring a new MFA challenge, is set to false by default.

Solution

To allow the browser to be remembered, the allowRememberBrowser option must be explicitly set to true when calling api.multifactor.enable(), e.g.:

api.multifactor.enable('any', { allowRememberBrowser: true });

More details about this default behavior can be found at Actions Triggers: post-login - API Object.