MFA Once Per Session Action

Knowledge Articles
1

Last Updated: Nov 29, 2024

Overview

This article details how to write an MFA Once Per Session Action.

Applies To

  • Action
  • Multifactor Authentication (MFA)
  • Single Page Application (SPA)

Solution

The below can be used to avoid prompting a user for multifactor authentication if they have successfully completed MFA in their current session.

/* triggers MFA once per session */
exports.onExecutePostLogin = async (event, api) => {
	if (!event.authentication.methods.find(({ name }) => name === 'mfa') ) {
       api.multifactor.enable("any", { allowRememberBrowser: true });
    }
};

This is particularly useful when performing silent authentication (prompt=none ) to renew short-lived access tokens in a Single Page Application (SPA) during the duration of a user’s session without having to rely on setting allowRememberBrowser to true .